# caa_blocks_issuance

A CAA record on the customer's domain doesn't allow our certificate authority to issue for it.

## What it means

CAA records let a domain owner name the certificate authorities allowed to issue for it. The customer's domain (or a parent of it) has CAA records, and none of them allows Let's Encrypt. DNS is verified and the domain is routed; it just cannot get a certificate, so it sits in `cert_failed`.

`status_detail.expected` is the exact record to add; `status_detail.registrable` is the zone it goes on.

## Why it happens

- The company restricts issuance to the CA it buys its own certificates from, and the policy predates this domain.
- A security scanner recommended adding CAA records and only the existing CA was listed.
- The CAA record sits on the registrable domain (`acme.com`) and so applies to every subdomain, including the one you added.

## What to do

1. Ask the customer to add `0 issue "letsencrypt.org"` at the root of their domain, next to their existing CAA records. Adding a record does not weaken their policy for anything else.
2. Or remove the CAA records entirely, if they are not needed.
3. Then retry: `POST /v1/domains/{id}/verify` or "Retry issuance" in the dashboard. We look the CAA records up again first, and only order the certificate once they allow it. We also re-check on our own with backoff (1 min, 5 min, 30 min, 2 h, then every 12 h).

- [Open this domain in the dashboard](/app/domains)
- [See the domain state machine](/docs/concepts/domain-states)

## In the API

```
"status": "cert_failed",
"status_reason":
  "caa_blocks_issuance",
"status_detail": {
  "registrable": "acme.com",
  "expected": {
    "type": "CAA",
    "name": "@",
    "value": "0 issue \"letsencrypt.org\""
  }
}
```