Ambiguous CAA DNS setup instructions may cause configuration failures

Technical Q&A
1

I encountered an issue while following Shopify’s domain setup instructions for adding a CAA record.

The current guidance displays:

  • Type: CAA

  • Name: [email removed]

  • Value: ssl.com

This presentation appears to assume that all DNS providers accept a simple value of ssl.com for CAA records.

However, many DNS management systems implement CAA records differently. Some providers require the full CAA syntax (for example, 0 issue "``ssl.com``"), while others expose separate fields for Flag, Tag, and Value. In these systems, entering only ssl.com results in validation errors and prevents the record from being created.

As a result, users may conclude that either their DNS provider or Shopify’s instructions are incorrect, when in reality the issue is a mismatch between the DNS provider’s implementation and the simplified example shown in the Shopify UI.

A more robust instruction could be:

“Create a CAA record authorizing SSL.com to issue certificates for this domain. Depending on your DNS provider, you may need to enter the record as 0 issue "ssl.com" or use separate Flag, Tag, and Value fields.”

This small clarification would help users across different DNS platforms and significantly reduce confusion during domain verification and SSL provisioning.

Thank you for considering this feedback.

2

I could be wrong, but this sounds like a very fringe case. Are you sure you need the CAA records to begin with? This is not a normal set up and connection to Shopify. They provision and manage their own SSL certificate, so I’m not sure if this is needed, unless your domain provider requires it. Most I’ve seen do not have them, and the only records needed are an A record and CNAME record.