Who is allowed to issue certificates for this domain?
Reads the CAA records that tell certificate authorities whether they may issue — following the climb up the parent names, so an inherited policy is shown along with the name it comes from.
Example result
Policy source
www.example-company.com publishes no CAA record of its own. Certificate authorities walk up the parent names until they find one, so the policy that actually governs it is the one on example-company.com — that is what the rows below describe. Adding a record directly on www.example-company.com would override it; leaving it inherited is a perfectly ordinary way to run this.
no CAA at www.example-company.com → applies from example-company.comStandard certificates
Only letsencrypt.org and digicert.com may issue standard certificates for names under example-company.com, including www.example-company.com. Any other certificate authority that checks CAA — which they are required to do — will refuse. If issuance ever fails unexpectedly, this is the first record to look at: a CA missing from this list cannot issue however the order was placed.
issue letsencrypt.org · issue digicert.comWildcard certificates
Wildcard certificates (*.example-company.com) are restricted separately: only digicert.com may issue them. When issuewild is present it overrides the issue list for wildcards specifically, so this is the rule that applies to them rather than the one above.
issuewild digicert.comViolation reports
A CA that is asked for a certificate this policy forbids is invited to report it to mailto:security@example-company.com. Reporting is a request rather than a requirement, and CAs vary in whether they act on it — but with no iodef there is nowhere for such a report to go at all.
iodef mailto:security@example-company.comExample result · public DNS lookups only · nothing stored · no account