CAA record blocks certificate renewal: how to find the cause and fix it
The short answer
Before a public CA issues a certificate it must read your CAA records, and it must refuse if they do not name it (RFC 8659, CA/Browser Forum Baseline Requirements 3.2.2.8). Renewal fails when the CAA record lists a different CA from the one renewing, when a malformed record names nobody, or when a wildcard is not allowed.
The math: which record the CA reads
A CA does not read your whole zone. It starts at the exact name on the certificate and walks up one label at a time, and the first name that has CAA records decides. Here a CDN tries to renew www.shop.example.com with Let's Encrypt:
| Name the CA queries | What it finds | Next |
|---|---|---|
www.shop.example.com | No CAA records | Go up one label |
shop.example.com | No CAA records | Go up one label |
example.com | 0 issue "digicert.com" | This set decides |
| Let's Encrypt (letsencrypt.org) is not in that set | Refused | |
The fix is one line on example.com: 0 issue "letsencrypt.org" next to the DigiCert line. Each CA you use needs its own issue record; the set is a list of CAs allowed, not a ranking.
What breaks, and who notices
- The CA refuses before any certificate exists. Your renewal job logs a CAA error and your site keeps serving the old certificate, so nothing looks wrong until that one expires. Baseline Requirements 3.2.2.8
- A malformed record names nobody. A common slip is pasting the flags and tag into the value field, which publishes something like 0 issue "0 issue letsencrypt.org". It matches no CA. If it is the only record, no CA may issue at all. RFC 8659 §4.2
- Wildcards follow their own rule. When issuewild records exist, they decide for wildcard certificates instead of issue, and 0 issuewild ";" forbids every wildcard. RFC 8659 §4.3
- The critical flag stops everything it does not understand. A record with flag 128 and a tag the CA does not know means the CA must refuse. RFC 8659 §4.1
- Shorter certificates leave less room. Public certificates go down to 100 days in March 2027 and 47 days in March 2029, so a renewal stuck on CAA reaches expiry sooner.
Check your CAA record
The free domain check reads the CAA records on your domain, checks them against the RFC 8659 format, and shows who issued the certificate you serve today.
Free, no account. We read only public DNS and what your servers show to anyone who connects.
Fix it, step by step
Find out which CA renews each certificate
Read the issuer of the certificate you serve today (the free check shows it on the certificate card) and ask whoever runs renewals: your CDN, hosting panel, load balancer or ACME client. One domain often uses two or three CAs.
Find the record the CA reads
Query CAA on the exact name, then on each parent up to your domain, for example dig CAA www.shop.example.com +short. The first name that answers with CAA records is the one that counts.
List every CA you use
One issue record per CA, using the CA's own identifier: letsencrypt.org, pki.goog for Google Trust Services, sectigo.com, digicert.com. Add issuewild records if you use wildcard certificates.
Get the format right
A CAA record is a flag, a tag and a quoted value: 0 issue "letsencrypt.org". In a DNS panel with separate fields, put only the CA name in the value field.
Add a reporting address
Add 0 iodef "mailto:security@example.com". A CA may use it to tell you about a request your policy refused.
Wait out the TTL and renew again
The CA reads the record live, but resolvers keep the old answer until its TTL runs out. Then run the renewal again and check the new certificate's issuer.
Common mistakes
Listing the CA you bought from, not the one your CDN uses
CDNs and hosting panels often renew with their own CA, and may switch between two of them. Your CAA has to name all of them.
In SkyQon's result: on a monitored domain, the alert “CAA will refuse your CA's next renewal” names the certificate, its CA and the line to add. The one-off free check shows the issuer on the certificate card for you to compare.
Pasting the flags into the value field
The panel already adds 0 issue; typing it again publishes a value that matches no CA.
In SkyQon's result: “CAA is published but authorises no certificate authority” when nothing valid is left, or “malformed CAA record published alongside valid ones” when a valid record still covers you.
Forgetting wildcard certificates
issue records do not cover a wildcard once any issuewild record exists, and 0 issuewild ";" forbids them all.
In SkyQon's result: on a monitored domain, a wildcard certificate is judged against your issuewild records whenever any exist, the way a CA judges it.
A subdomain with its own CAA set
A CAA set on a subdomain replaces the one on your domain for every name below it, so a CA you added at the top can still be refused there.
In SkyQon's result: CAA is read the way a CA reads it, from the name up to the first name that has records. For a name that receives mail, the finding says which name that was. For a web-only name, the blocked-renewal alert names it.
What SkyQon does and does not do
What it finds
The CAA records that apply to your domain, read the way a CA reads them (from the name up to the first name that has records) and checked against the RFC 8659 format. On a monitored domain, also whether the CA behind each certificate you serve may renew it.
What you get
The exact record to publish. On Pro and up, SkyQon can also create or repair the CAA record through your DNS provider's API when you ask it to, with an undo.
What it is not
We change your DNS only when you ask us to (Pro and up). A certificate from a CA we do not recognise is never judged, so it gets no renewal warning. The one-off free check does not compare CAA with your certificate.
CAA records: questions people ask
Is a CAA record required?
What identifiers do the big CAs use?
Do I need CAA on every subdomain?
What does issuewild do?
What does the 128 flag mean?
Does CAA stop misuse of a certificate already issued?
Does CAA apply to my internal CA?
What about a name that is a CNAME?
How fast does a change take effect?
Find a CAA block before your renewal does.
The free check reads the CAA records that apply to your domain and your certificate in one go. Add the domain to the free plan and every scan checks that your certificate's CA may still renew it.