A CAA record marked critical uses a tag no authority understands

HighConfirmedQuick windns.records.caa-critical-unknown-tag

What this check looks for

One of your CAA records is flagged as must-understand and uses a name that certificate authorities do not recognise. Every authority is required to refuse to issue rather than guess, so no certificate can be issued at all.

Why it matters

This blocks issuance completely and the failure appears at your CA, not in your DNS: renewals stop working with an error message about CAA that points at a tag nobody can explain. It is usually a typo.

When the check passes, your report says: “Every critical CAA tag is one authorities understand”.

What it costs your score

When this check fails it removes 10 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.

It shares the dns.records.caa family ceiling of 15 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.

Severity: high
Default confidence: confirmed
Status when triggered: fail
Deduction: 10 points
Family cap: dns.records.caa · 15
Category: DNS
Module: Dns records
Fix owned by: dns host
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Correct the tag name, or clear the critical flag on that record.

A critical tag no CA understands blocks every certificate for this domain.

Check the tag against IANA's registry: issue, issuewild, iodef, issuemail, contactemail, contactphone, issuevmc, and the reserved auth, path and policy. A tag on that list is understood by a CA even if we do not grade its value, so it is not what is blocking issuance.
If it is a typo, correct it and keep the flag.
If the tag is intentional and experimental, set the flags byte to 0 so authorities may ignore it instead of refusing.
Force a certificate renewal to confirm issuance works again.

How to confirm it worked

dig +short CAA ‹domain› — expect no critical flag on an unknown tag

The configuration to publish

{{domain}}. 3600 IN CAA 0 issuewild "letsencrypt.org"

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

These CAA properties have the critical flag (bit 0 of the flags byte) set and a tag that is not in IANA's registry of CAA property tags: ‹tag list›. RFC 8659 §4.1 requires a CA that meets a critical property it does not understand to refuse the request, so a misspelling such as issuewilde with the critical flag set blocks every issuance for the domain.

**The registered tags are** issue, issuewild and iodef (RFC 8659), issuemail (RFC 9495), contactemail and contactphone (CA/Browser Forum ballots), issuevmc (VMC Requirements, used for BIMI mark certificates), and the three RFC 8659 reserves auth, path and policy. None of those is reported here, whether or not it is critical.

**What we evaluate is a smaller set than what we recognise.** We grade the values of issue, issuewild, issuemail and iodef. The others we recognise as registered and say nothing about — a contactemail value is not checked, and its absence is not a finding.

Standards and references

RFC 8659 §4.1 — Canonical presentation format § 4.1

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns records checker Build the fix