Place policy at the right DNS name
CAA policy can be evaluated for a requested hostname and inherited from a parent name when no closer policy exists. Check the exact hostname and relevant records before assuming a root-domain change covers every subdomain.
Use issuer identifiers and issuewild or reporting tags according to the certificate authority's documentation. A spelling error, unsupported value, or omitted automated-renewal provider can prevent issuance.
Validate changes before certificate renewal
Inventory certificate providers for the apex and subdomains, including alternate recovery paths, then authorize only the intended issuers. Identifiers are provider-specific, so do not copy sample values blindly.
After changing CAA, query authoritative DNS and confirm resolver-visible records. Test issuance or renewal through the provider's supported process and retain a way to correct policy before certificates near expiration.