Edit a domain’s CAA DNS record to get Symantec Partner certificates

Solution ID:    SO28416    Updated:    07/31/2017


To get Symantec certificates for your domain, update the CAA DNS Resource Record to state that Symantec is approved to issue certificates for your domain.

The registered domain owner must update the CAA DNS zone file to add Symantec as an approved CA in a CAA DNS record. You can find information about how to access and edit the CAA DNS zone file for the domain by contacting the domain’s registrar.

  1. Open the CAA DNS zone file for editing.
  2. Under $ORIGIN symantecoffer.com, add the line:  CAA 0 issue “symantec.com” as follows:
    $ORIGIN symantecoffer.com
    . CAA 0 issue "symantec.com"
  3. On your certificate's Order Information page in Symantec Partner Center, click Recheck CAA. If the check succeeds, your order is processed normally.

The single CAA record applies to all web servers in your domain, like www.symantecoffer.com, shop.symantecoffer.com, checkout.symantecoffer.com, etc.

What is CAA?
Certification Authority Authorization (CAA) allows a website owner to specify the Certificate Authorities that are authorized to issue certificates for that domain or website. For additional details, please see Certification Authority Authorization (CAA)

Contact Support

Find Answers