---
title: How do I change CAA records when using the Vercel CNAME record?
description: Information on how to change CAA records when using the Vercel CNAME record.
url: /kb/guide/change-caa-records-with-vercel-cname
canonical_url: "https://vercel.com/kb/guide/change-caa-records-with-vercel-cname"
published: 2025-11-03
last_updated: 2026-02-24
authors: Rob Peters
related: []
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---
<!-- docsgraph:related -->
## Related pages

> **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below.

- [Troubleshooting Domains](https://vercel.com/docs/domains/troubleshooting?from=related) — Learn about common reasons for domain misconfigurations and how to troubleshoot your domain on Vercel.
- [Can a CAA record be added to a Subdomain Configured with CNAME?](https://vercel.com/kb/guide/can-a-caa-record-be-added-to-a-subdomain-configured-with-cname?from=related) — This guide is for any users with requirements on customization of CAA records on subdomains.
- [Managing DNS Records](https://vercel.com/docs/domains/managing-dns-records?from=related) — Learn how to add, verify, and remove DNS records for your domains on Vercel with this guide.
- [Working with DNS](https://vercel.com/docs/domains/working-with-dns?from=related) — Learn how DNS works in order to properly configure your domain.
- [Configuring Domains](https://vercel.com/docs/platforms/multi-tenant-platforms/configuring-domains?from=related) — Add, verify, redirect, and remove wildcard and custom domains for a multi-tenant application using the Vercel SDK.
- [Can I use my domain on Vercel with A records?](https://vercel.com/kb/guide/a-record-and-caa-with-vercel?from=related) — Point your apex domain to Vercel with an A record \(76.76.21.21 or your domain card's value\), pair it with a www CNAME,
- [Why is my Vercel domain not verified?](https://vercel.com/kb/guide/why-is-my-vercel-domain-unverified?from=related) — Information on why a Vercel domain may not be verified and how to verify it.
- [Can I use wildcard domains without switching to Vercel Nameservers?](https://vercel.com/kb/guide/wildcard-domain-without-vercel-nameservers?from=related) — Information on how to use wildcard domains without Vercel Nameservers
- [How do I change my Nameservers on Vercel?](https://vercel.com/kb/guide/how-do-i-change-my-nameservers-on-vercel?from=related) — Learn about how to change Nameservers for domains registered with Vercel.

Full cross-link map for this page: [/kb/guide/change-caa-records-with-vercel-cname.graph.md](/kb/guide/change-caa-records-with-vercel-cname.graph.md)
<!-- /docsgraph:related -->


Due to how CNAME records work, any subdomain using a Vercel CNAME automatically inherits Vercel's predefined CAA records, preventing custom CAA at that level.

Vercel cannot modify CAA on its CNAME targets or add your custom records there.

### Changing CAA with CNAME

Vercel's CNAME CAA settings are optimised for seamless Vercel certificate issuance across custom domains. Non-Enterprise users can't upload custom SSL certs anyway, so review your certificate's purpose before altering CAA. For certificates on other platforms (e.g., AWS), simply repoint the CNAME to that provider to bypass Vercel's CAA.

### Multi-Provider or Complex Setups

If using multiple hosts, proxies, or UCC/SAN certs with a SAN on Vercel CNAME, replace the CNAME with an A record (IPs shown in [Project Domains](https://vercel.com/d?to=%2F%5Bteam%5D%2F%5Bproject%5D%2Fsettings%2Fdomains&title=Go+to+Project+Domains)) to enable custom CAA. Then add CAA at the subdomain or apex level (or both). See [**Can I use A records with Vercel?**](https://vercel.com/guides/a-record-and-caa-with-vercel).​

**NOTE**: Any custom CAA must include `0 issue "letsencrypt.org"` for Vercel cert issuance.