What is it?
CAA records tell the DNS ecosystem which certificate authorities are allowed to issue TLS certificates for your domain. This warning belongs to DNS and certificate issuance hygiene. It does not mean the current certificate is broken; it means the domain has not published an issuance policy.
Why does it matter?
Without CAA, any publicly trusted certificate authority can issue a certificate for the domain if its validation process succeeds. Publishing CAA narrows that surface and gives you a place to route certificate issuance incident reports.
How to fix it?
Add CAA records for the certificate authority you actually use, then verify that certificate renewal still works.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"If you use multiple CAs, publish one issue record for each authorized CA. Do not publish restrictive CAA records until you know which CA your CDN, hosting provider, or managed certificate service uses.