---
title: How do I change CAA records when using the Vercel CNAME record?
description: Information on how to change CAA records when using the Vercel CNAME record.
url: /kb/guide/change-caa-records-with-vercel-cname
canonical_url: "https://vercel.com/kb/guide/change-caa-records-with-vercel-cname"
last_updated: 2026-02-24
authors: Rob Peters
related: []
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

Due to how CNAME records work, any subdomain using a Vercel CNAME automatically inherits Vercel's predefined CAA records, preventing custom CAA at that level.

Vercel cannot modify CAA on its CNAME targets or add your custom records there.

### Changing CAA with CNAME

Vercel's CNAME CAA settings are optimised for seamless Vercel certificate issuance across custom domains. Non-Enterprise users can't upload custom SSL certs anyway, so review your certificate's purpose before altering CAA. For certificates on other platforms (e.g., AWS), simply repoint the CNAME to that provider to bypass Vercel's CAA.

### Multi-Provider or Complex Setups

If using multiple hosts, proxies, or UCC/SAN certs with a SAN on Vercel CNAME, replace the CNAME with an A record (IPs shown in [Project Domains](https://vercel.com/d?to=%2F%5Bteam%5D%2F%5Bproject%5D%2Fsettings%2Fdomains&title=Go+to+Project+Domains)) to enable custom CAA. Then add CAA at the subdomain or apex level (or both). See [**Can I use A records with Vercel?**](https://vercel.com/guides/a-record-and-caa-with-vercel).​

**NOTE**: Any custom CAA must include `0 issue "letsencrypt.org"` for Vercel cert issuance.