Blog/
CAA records and Let’s Encrypt: fix “unauthorized CAA” failures
Why Let’s Encrypt fails with CAA errors, how DNS CAA records work, and how to check CAA before your next certificate renewal.
CAA (Certification Authority Authorization) is a DNS record that lists which certificate authorities may issue TLS certificates for your domain. If CAA exists and does not allow Let’s Encrypt (or your CA), ACME issuance fails even when HTTP-01 looks correct.
Typical error clues
Certbot and other ACME clients mention CAA, “unauthorized,” or policy. The failure appears suddenly after someone added CAA for a corporate PKI and forgot letsencrypt.org — or after a DNS template copied restrictive CAA from another zone.
What a permissive Let’s Encrypt CAA looks like
You generally need an issue (and often issuewild) property that allows letsencrypt.org, unless you intentionally use another CA only. Empty CAA means “any CA may issue.” Multiple CAA records are normal; at least one must authorize the CA you use.
Confirm CAA alongside A/AAAA before renewing.
After you fix CAA
Wait for DNS TTL, verify on more than one resolver, then retry ACME. When the new cert is live, confirm expiry and SAN with an SSL checker so you did not leave an old certificate on another node.