What is CAA?

CAA (Certification Authority Authorization) is a DNS record that names which certificate authorities are allowed to issue a certificate for a domain. Without one, any of the hundreds of publicly trusted CAs in the world can issue a certificate for it - CAA is what lets a domain owner restrict that in advance, rather than only finding out after the fact via Certificate Transparency logs.

Absence isn't always what it looks like

An empty CAA lookup on the exact domain you're checking doesn't necessarily mean "unrestricted" - RFC 8659 has a domain with no CAA record of its own defer to its parent zone, all the way up. A subdomain with no CAA record can still be fully restricted by a record set higher up the tree. This check follows that chain rather than stopping at the first empty answer.

Where the chain stops climbing

Working out exactly where a domain's "own" boundary ends and a shared registry suffix begins needs real Public Suffix List logic - the same distinction browsers use to know that example.co.uk is one registrable domain but co.uk itself isn't. This check uses that real boundary (lib/public-suffix.php) rather than a simple "stop at two labels" guess, which would climb one level too far or not far enough on exactly this kind of multi-label suffix.

issue vs issuewild

The issue tag restricts standard certificates; issuewild separately restricts wildcard certificates (e.g. *.example.com) and, if absent, simply falls back to whatever issue allows. A value of ; instead of a CA's hostname is valid and means "no CA is authorised at all" for that tag - a deliberate way to block issuance entirely, easy to set by mistake too.

The iodef tag

The optional iodef tag gives a CA somewhere to report an issuance request it refused because it wasn't authorised - useful visibility into attempted or accidental mis-issuance, similar in spirit to how DMARC and TLS-RPT give visibility elsewhere.