CAA issuewild vs issue

CAA issue controls which certificate authorities may issue certificates for exact hostnames. CAA issuewild does the same job for wildcard certificates. If you publish only issue and later request a wildcard, some CAs will refuse the request. AutoSSL on our cPanel plans uses HTTP-01 and will not issue wildcards anyway, so issuewild mainly matters when you buy a wildcard or use DNS-01 validation.

What each flag allows

Publish issue at the apex for every CA you actually use. Let’s Encrypt is the CA AutoSSL uses. A commercial CA or a CDN CA only belongs in the list if that party will issue for you. CAA records apply down the DNS tree unless a more specific CAA record overrides them. Empty CAA output means any CA may issue, which is the old default.

If you want wildcards from a given CA, add a matching issuewild value for that CA. If you never want a wildcard from anyone, set 0 issuewild ";" to deny them. Do not set a deny and then order a wildcard from a vendor; the CA is following the policy you published.

A safe order of steps

1. List the CAs you truly need. Include Let’s Encrypt when AutoSSL should keep working.
2. Publish 0 issue "letsencrypt.org" and any other required CA at the domain apex.
3. Add 0 issuewild "letsencrypt.org" (or your commercial CA) only if you will request a wildcard.
4. Request the certificate after the records are live. If a request failed earlier, wait a minute and try again.

dig example.com CAA

You should see issue and, when you set it, issuewild. An iodef record can send mail about issuance attempts; use a mailbox you actually read. After CDN onboarding, people often paste a CAA that lists only the CDN’s CA. AutoSSL then fails with a refusal that can look like a firewall problem. Add Let’s Encrypt, or remove the CAA record until you know you need one.

When issuewild actually matters here

Wildcards from AutoSSL are not available with HTTP-01, so everyday shared hosting often only needs a correct issue line for Let’s Encrypt. Still treat issuewild as a deliberate choice, not a paste from a vendor lockdown guide. Do not copy a CDN CAA that only allows their CA unless you intend to lock issuance to that CA alone.

DNSSEC DS at the parent is a different parent-side record. If SERVFAIL appeared after you changed DNS policy records and you are unsure which one broke resolution, see DS records at the parent.