Add an issue tag to your CAA record

Why it matters

The CAA record set has no `issue` property (issuewild only limits wildcard certificates), so it does not restrict which authorities may issue ordinary certificates. It gives a false sense of control.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. List every CA that issues certificates for the domain and its subdomains (hosting or CDN platform, ACME clients, purchased certificates, crt.sh issuers).
2. Add an issue record for each one. Once you do, every CA not listed is refused, so a missing one breaks its next renewal.
3. If the existing record is only an iodef reporting address, keep it and add the issue records beside it.
4. Test with the command below and run a renewal dry-run on each ACME client.

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CAA records check
• Add a CAA record that names your certificate authority
• Fix the misspelled CAA tag
• Fix the unreadable CAA record