Introduction

CAA records tell certificate authorities which issuers may issue certificates for a domain. Renewals fail when the authoritative zone blocks Let's Encrypt, even if the DNS control panel you changed looks correct. This is especially common in multi-provider DNS setups where the parent zone and delegated subdomain live in different places.

Symptoms

  • Let's Encrypt or ACME clients report CAA authorization failures during renewal
  • The DNS panel appears to contain the right record, but issuance still fails
  • The problem affects one subdomain or environment but not the root domain
  • Renewal failures began after DNS migration, delegation, or security hardening

Common Causes

  • The authoritative zone has no issue tag for Let's Encrypt
  • CAA records were updated in the wrong DNS provider or hosted zone
  • A parent zone CAA policy overrides what the team expected for a delegated name
  • Automation recreated CAA records with a different issuer set

Step-by-Step Fix

  1. 1.Query CAA records from an external resolver
  2. 2.Check the live authoritative answer rather than trusting a DNS control panel screenshot.
bash
nslookup -type=CAA example.com 8.8.8.8
nslookup -type=CAA sub.example.com 8.8.8.8
  1. 1.Confirm which zone is authoritative for the affected name
  2. 2.A delegated subdomain must be fixed in its own authoritative zone, not necessarily in the parent.
bash
nslookup -type=NS example.com
nslookup -type=NS sub.example.com
  1. 1.Add or correct the CAA records for Let's Encrypt
  2. 2.Allow the issuer you actually use, and keep the record set consistent across providers.
dns
example.com. 300 IN CAA 0 issue "letsencrypt.org"
example.com. 300 IN CAA 0 iodef "mailto:ops@example.com"
  1. 1.Retry the renewal only after public DNS is correct
  2. 2.An immediate ACME retry before DNS answers are right only produces the same failure again.
bash
certbot renew --dry-run

Prevention

  • Track authoritative DNS ownership for every delegated zone
  • Review CAA policy whenever certificate providers or DNS providers change
  • Validate CAA records from external resolvers before scheduled renewal windows
  • Keep certificate automation and DNS automation aligned on the same issuer policy