webzod
account

Fix the unreadable CAA record

dns.caa.invalid · effort: minutes

Why it matters

A CAA record has a value that cannot be parsed, so a certificate authority may treat it as an error and refuse to issue or renew your certificates. A stray quote, space or missing value is enough.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. List the record with the command below and look for a malformed value. The format is flags, tag, then the value in quotes, for example 0 issue "letsencrypt.org".
  2. Some DNS dashboards want the quotes in the value field and some add them for you. Use the dashboard's own convention, so you do not end up with doubled quotes.
  3. For an iodef record the value must be a full URL, such as mailto:security@example.com or an https:// address, not a bare email address.
  4. Correct or delete the record, then run a renewal dry-run on each ACME client.
bash 
dig CAA example.com +short
# zone file lines (for DNS dashboards, enter flags, tag and value separately):
# example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
# example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.