CAA Record Builder (DNS Certificate Authority Authorization)

On the same domain you want to protect. CAA lookup walks up from the requested name to the apex — a cert for api.example.com triggers lookups at api.example.com, then example.com, then root. Most people put one CAA set on the apex and let it cover all subdomains. Subdomain-specific CAA only matters if you want a different policy there.

Yes — if you have any issue records and no issuewild records, the issue records also restrict wildcards. But if you have any issuewild record at all, it overrides for wildcards. The safest pattern is to explicitly list both when you want both regular and wildcard issuance, or to add only issue if you never need wildcards. Adding ; to issuewild while permitting regular certs is a common 'no wildcards from anyone' policy.

Bit 7 (value 128) is the issuer-critical flag. When set on an unknown tag, CAs must refuse to issue. Today only issue, issuewild, and iodef are defined, so critical mostly affects future-compatibility. Leave it off (flags = 0) for typical setups; only use 128 if you're deliberately specifying a tag you require all CAs to understand.

Per the Baseline Requirements, CAs check CAA at the moment of issuance, with a maximum lookup TTL of 8 hours from when they cached an earlier value. So a new record can take up to 8 hours to take full effect across all CAs. To prevent old cached negatives from blocking issuance, give your records a TTL of 5-60 minutes during initial setup and increase later.

If your zone is DNSSEC-signed, CAs must verify the signatures and treat unsigned responses as missing. So a misconfigured DNSSEC can break CAA checking and stall cert renewals. Validate the zone with a tool like dnsviz.net before relying on CAA enforcement.