Fix the misspelled CAA tag

Why it matters

A CAA record uses a tag that no certificate authority recognises, usually a typo such as isue. The record you meant to write is therefore ignored, and if it is marked critical it can block all issuance.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. List your CAA records with the command below and spot the unusual tag. The common valid tags are issue, issuewild and iodef; issuemail, issuevmc, contactemail and contactphone are valid as well.
2. Correct the tag, or delete the record if it was a mistake. Once the intended issue record works, it begins restricting issuance, so first make sure it lists every CA you use.
3. A record whose flags value is 128 (critical) with a tag the CA does not know makes the CA refuse to issue at all. If certificates are failing, fix this first.
4. Run a renewal dry-run on each ACME client to confirm it still works.

dig CAA example.com +short
# wrong:   0 isue "letsencrypt.org"
# correct: 0 issue "letsencrypt.org"
# zone file line (for DNS dashboards, enter flags, tag and value separately):
# example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CAA records check
• Add a CAA record that names your certificate authority
• Add an issue tag to your CAA record
• Fix the unreadable CAA record