Our main web site uses HTTPS certificates issued by comodo. So we have two CAA records like this:

@        CAA        0 issue "comodo.com"
www      CAA        0 issue "comodo.com"

And we have multiple sub-domains with HTTPS certificates served by letsencrypt. Example CAA records like:

test1    CAA        0 issue "letsencrypt.org"
test2    CAA        0 issue "letsencrypt.org"
other    CAA        0 issue "letsencrypt.org"

At the moment, when we have a new sub-domain, besides an A-record I also have to create a new CAA record. Can't I have a wild-card as sub-domain name, like this?

*    CAA        0 issue "letsencrypt.org"

(I've tested this, but it doesn't work)

For the record: I'm not talking about wild-card domain certificates.

  • 1
    What errors are you getting from the CAA wildcard? It kinda looks like it should work.
    – Zoredache
    Jun 24, 2019 at 21:28
  • Letsencrypt just responds as if the record does not exist. But according to the answer of Hakan and Allan, I just should replace the * with a @ sign.
    – doekman
    Jul 2, 2019 at 7:36
  • What does the (at) @ sign signify in your example, is this where the domain name param is eneterd by the DNS system?
    – snh_nl
    Feb 23, 2021 at 12:55

2 Answers 2


CAA records are inherited by subdomains - you do not need to publish them under subdomains, as pointed out by Håkan Lindqvist. Ignoring subdomains, you can have multiple CAA records at your domain, e.g.

@        CAA        0 issue "comodo.com"

@        CAA        0 issue "letsencrypt"

issuewild is the context you are looking for IF you want to authorise letsencrypt to issue wildcard certs, e.g.

@        CAA        0 issuewild "comodo.com"

@        CAA        0 issuewild "letsencrypt"

Personally I only publish one CAA record at my domain, I do not publish them for subdomains, and I use non-wildcard letsencrypt certificates for subdomains without issue.

P.S. Wildcard DNS records only resolve for subdomains that DO NOT exist, which is commonly misunderstood. This is what Håkan Lindqvist was saying when he mentioned that. Inheritance enables you to use @ CAA instead of * CAA.


Technically, it's certainly possible to have a wildcard CAA record (and it does "work").

However, the way wildcards in DNS are defined, this is probably not actually useful for your use-case as a wildcard only applies to names in branches that do not exist.

Presumably you have at least address records (A/AAAA) for all these names that you want to get certificates for, and by having those address records in place the wildcard no longer applies there. So wildcards are almost certainly a no-go for what you want to do.

I think what you will want to do is either add CAA records for all these names or live with a less strict policy on the level above (ie, comodo + letsencrypt in your example) and make use of the built-in policy inheritance in the CAA spec.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.