What happens without CAA records?

Any publicly trusted CA may issue for the domain. CAA narrows that to the CAs you list.

My certificate renewal failed after adding CAA. Why?

The CA you renew with must appear in an issue (or issuewild for wildcards) tag on the name or a parent.

CAA Lookup

A CAA record lists which certificate authorities may issue TLS certificates for a domain. This lookup shows those records and where violation reports go, so you can see why a certificate request might be refused.

When to use this: A certificate authority refuses to issue for your domain, or you want to lock issuance to the CAs you use. Command prefix caa:

About the CAA Lookup

See which certificate authorities a domain allows to issue TLS certificates for it, and where violations are reported.

FAQ

What happens without CAA records?: Any publicly trusted CA may issue for the domain. CAA narrows that to the CAs you list.
My certificate renewal failed after adding CAA. Why?: The CA you renew with must appear in an issue (or issuewild for wildcards) tag on the name or a parent.