Should I specify CAA records for www subdomain too?

Question

I pre-paid 5 years of AlpiroSSL Premium (English info here), it's from Sectigo originally, but the certificate provider told me the right CAA is (or should be) trust-provider.com as per my current settings. I may switch to Let's Encrypt sometime in the future though, so I kept it there for hosting's sake. Anyway, my question is, if specifying CAA for both the domain and www subdomain makes sense?

0 issue "trust-provider.com"
0 issue "letsencrypt.org"
0 issuewild ";"
0 iodef "mailto:[email protected]"

---

DNS CAA currently set

---

SSL Labs showing CAA

Answer 1

Anyway, my question is, if specifying CAA for both the domain and www subdomain makes sense?

Not necessarily except if you really need that. Why? Because CAA records cascade.

Per RFC 8659 section 3, if a system has to find out a CAA record for www.example.com, it tries this name first, and if no response found, it continues "climbing up the root" and hence will try a CAA request on example.com (and theoretically later even on com and . in fact).

So, said differently, if you put a CAA record on example.com without any other records elsewhere in the zone, then that specific record will apply to all names in the zone.

Bases on your screenshot, you have the same CAA record on www and at apex, so the one at www is redundant but harmless.