2

I pre-paid 5 years of AlpiroSSL Premium (English info here), it's from Sectigo originally, but the certificate provider told me the right CAA is (or should be) trust-provider.com as per my current settings. I may switch to Let's Encrypt sometime in the future though, so I kept it there for hosting's sake. Anyway, my question is, if specifying CAA for both the domain and www subdomain makes sense?

0 issue "trust-provider.com"
0 issue "letsencrypt.org"
0 issuewild ";"
0 iodef "mailto:admin@vlastimilburian.cz"

DNS CAA currently set

DNS CAA currently set


SSL Labs showing CAA

SSL Labs showing CAA

0
2

Anyway, my question is, if specifying CAA for both the domain and www subdomain makes sense?

Not necessarily except if you really need that. Why? Because CAA records cascade.

Per RFC 8659 section 3, if a system has to find out a CAA record for www.example.com, it tries this name first, and if no response found, it continues "climbing up the root" and hence will try a CAA request on example.com (and theoretically later even on com and . in fact).

So, said differently, if you put a CAA record on example.com without any other records elsewhere in the zone, then that specific record will apply to all names in the zone.

Bases on your screenshot, you have the same CAA record on www and at apex, so the one at www is redundant but harmless.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.