A CAA failure can mean that your DNS policy does not authorise the requested certificate authority, or that the authority cannot reliably read the policy. Establish which failure occurred before editing records.
01 Investigate the issuance block
- Record the certificate order, every requested hostname and the exact CAA or DNSSEC error. Check the actual issuing authority rather than guessing from a storefront brand.
- Ask the DNS administrator to inspect the effective CAA policy for each name, including inherited policy and relevant alias targets.
- If the intended authority is not allowed, confirm the organisation's certificate policy and add the issuer's documented authorisation. Review wildcard-specific authorisation when the request includes a wildcard.
- If the lookup fails, check authoritative DNS availability, alias loops and DNSSEC health. A failed lookup is different from a valid response containing no CAA restriction.
- Verify the corrected public answers, then retry issuance. Keep a record of why the policy changed and which other certificate services depend on it.
Common questions
Should I delete every CAA record?
First identify the intended policy. Removing all restrictions can broaden which authorities may issue certificates and does not repair a DNS resolution failure.
Is DNSSEC now required to buy a certificate?
DigiCert checks DNSSEC when present and has enforced those checks since 3 March 2026. A broken signed configuration can block validation or issuance, but using DNSSEC is not itself mandatory for a certificate.
Why can another certificate still work?
CAA is checked for issuance. A previously issued certificate may continue serving while a new request fails, and different hostnames can have different effective policies.
Who should receive the support request?
Include both the certificate order owner and DNS administrator. Provide the error and affected name, not account passwords.