Certificate Authority Authorization (CAA) records control which certificate authorities can issue certificates for a domain. A restrictive CAA policy can prevent a HeySummit custom domain’s SSL certificate from becoming active.
Check where the restriction applies
Check the affected hostname, its parent domain and the CNAME target chain. CAA records can be inherited, and a CNAME target’s restrictions can matter even when your own hostname has no CAA record. Ask your DNS administrator or provider to help identify the applicable policy.
Allow the certificate authority in use
HeySummit uses Cloudflare to provision custom-domain certificates. Cloudflare supports multiple certificate authorities, so do not assume every certificate problem is fixed by allowing only Google Trust Services. Check the validation error or contact support to confirm the required authority. If Google Trust Services is required, Google documents this example:
Type: CAA
Name: the affected domain or hostname as required by your DNS provider
Value: 0 issue "pki.goog"
When your DNS provider has separate fields, use flag 0, tag issue, and CA domain pki.goog. Preserve other authorised certificate authorities needed by your organisation. See Google’s CAA guidance and Cloudflare’s current certificate-authority reference for the applicable values.
Check the remaining domain records
Go to Event Settings > Branding and Site Settings > Event Domain. Keep the CNAME record pointing to fallback.heysummit.com and add any current TXT verification records shown by HeySummit. CAA permissions do not replace those records. After DNS updates have taken effect, return to Event Domain and select Refresh Status for the registered custom domain. If it still fails, send support the hostname and exact validation error. See Cloudflare’s CAA and CNAME-chain guidance for more detail.