# How mandatory is that CAA record for chatmail relays? **URL:** \ **Category:** Chatmail Relays\ **Tags:** chatmail\ **Created:** [June 22, 2026, 7:20pm UTC](https://forum.delta.chat/t/how-mandatory-is-that-caa-record-for-chatmail-relays/5460 "2026-06-22T19:20:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![esbeeb](https://forum.delta.chat/user_avatar/forum.delta.chat/esbeeb/32/3092_2.png) [@esbeeb](https://forum.delta.chat/u/esbeeb)\ **Post date:** [June 22, 2026, 7:20pm UTC](https://forum.delta.chat/t/how-mandatory-is-that-caa-record-for-chatmail-relays/5460/1 "2026-06-22T19:20:32Z")
I’ve set up my first chatmail server on an available domain I own. For the sake of example, let’s pretend it’s [example.com](http://example.com) It’s a VPS running Debian 12. I created all the DNS records it asked. It creates a CAA record looking like: ```auto example.com. 3600 IN CAA 0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890" ``` I was using several subdomains for other projects, say [othersite1.example.com](http://othersite1.example.com), and [othersite2.example.com](http://othersite2.example.com) These are on other VPS with different IP addresses, and they had their own respective Let’s Encrypt SSL certs. But now as I understand, that CAA record above sort of monopolizes the entire [example.com](http://example.com) domain, for getting Let’s Encrypt SSL certs! My SSL certs for [othersite1.example.com](http://othersite1.example.com), and [othersite2.example.com](http://othersite2.example.com) will eventually expire, and I won’t be able to renew them! **Can I just stop hosting the CAA record, to release the “exclusive lock” (as it were) on my VPS’ static IP addresses (IP4 and IP6), used by the chatmail relay, for obtaining Let’s Encrypt SSL certs?** I didn’t realize I had to “give up” all that domain to my chatmail relay, so to speak. ---
**Author:** ![link2xt](https://forum.delta.chat/user_avatar/forum.delta.chat/link2xt/32/1971_2.png) [@link2xt](https://forum.delta.chat/u/link2xt)\ **Post date:** [June 22, 2026, 8:54pm UTC](https://forum.delta.chat/t/how-mandatory-is-that-caa-record-for-chatmail-relays/5460/2 "2026-06-22T20:54:14Z")
Similar question is already answered here and there are more topics if you search for “CAA”: > [@The accounturi parameter at Chatmail server DNS records](https://support.delta.chat/t/the-accounturi-parameter-at-chatmail-server-dns-records/4182/3): > > CAA record is not very important, you can skip adding it if it’s impossible. But may be better to switch to another DNS server in any case because there is no reason for not being able to setup CAA records. If DNS provider cannot provide an interface to add CAA records they likely don’t care much about their DNS service. For the reasons to add CAA records you can read You can remove CAA record, but it’s better to instead set up CAA records for subdomains. Subdomain CAA records override the top level CAA records: [RFC 8657: Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding | RFC Editor](https://www.rfc-editor.org/info/rfc8657/#section-5.7-1) ---
**Author:** ![esbeeb](https://forum.delta.chat/user_avatar/forum.delta.chat/esbeeb/32/3092_2.png) [@esbeeb](https://forum.delta.chat/u/esbeeb)\ **Post date:** [June 22, 2026, 9:07pm UTC](https://forum.delta.chat/t/how-mandatory-is-that-caa-record-for-chatmail-relays/5460/3 "2026-06-22T21:07:47Z")
I did a search before posting, but couldn’t recognize that answer. OK, so I can also create CAA records for [othersite1.example.com](http://othersite1.example.com), and [othersite2.example.com](http://othersite2.example.com), and then Let’s Encrypt will be happy again for renewing those subdomains? ---
**Author:** ![link2xt](https://forum.delta.chat/user_avatar/forum.delta.chat/link2xt/32/1971_2.png) [@link2xt](https://forum.delta.chat/u/link2xt)\ **Post date:** [June 22, 2026, 9:20pm UTC](https://forum.delta.chat/t/how-mandatory-is-that-caa-record-for-chatmail-relays/5460/4 "2026-06-22T21:20:51Z")
Assuming subdomains fail to renew because you use different account numbers, adding CAA records for subdomains with correct account numbers should work. ---
**Author:** ![r10s](https://forum.delta.chat/user_avatar/forum.delta.chat/r10s/32/1513_2.png) [@r10s](https://forum.delta.chat/u/r10s)\ **Post date:** [October 6, 2026, 3:41pm UTC](https://forum.delta.chat/t/how-mandatory-is-that-caa-record-for-chatmail-relays/5460/5 "2026-10-06T15:41:01Z")