Fix the unreadable CAA record
Why it matters
A CAA record has a value that cannot be parsed, so a certificate authority may treat it as an error and refuse to issue or renew your certificates. A stray quote, space or missing value is enough.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- List the record with the command below and look for a malformed value. The format is flags, tag, then the value in quotes, for example 0 issue "letsencrypt.org".
- Some DNS dashboards want the quotes in the value field and some add them for you. Use the dashboard's own convention, so you do not end up with doubled quotes.
- For an iodef record the value must be a full URL, such as mailto:[email protected] or an https:// address, not a bare email address.
- Correct or delete the record, then run a renewal dry-run on each ACME client.
bash
dig CAA example.com +short # zone file lines (for DNS dashboards, enter flags, tag and value separately): # example.com. 3600 IN CAA 0 issue "letsencrypt.org" # example.com. 3600 IN CAA 0 iodef "mailto:[email protected]"
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.