However the domain theworkflowexpert.inmotionnow.com does not appear to have a CAA record, and we don't get a SERVFAIL when doing a query, so it's not really clear how we can fix this. Any tips from the Boulder logs as to what might be going wrong?
CAA records are “inherited” by subdomains if they have no CAA record of their own. If you have sufficient control over the subdomain to add your own CAA record on it, you can get around this, but otherwise, you (or whoever controls the domain) would need to change or remove the CAA record on inmotionnow.com.
As @pfg points out (thanks!) the problem is with the parent domain of "theworkflowexpert.inmotionnow.com". A common point of confusion with UnboundTest is that it doesn't implement the CAA checking algorithm that Boulder uses, it only recreates single queries. This makes sense since it's a vanilla Unbound instance and Unbound wouldn't have any need to implement the CAA checking algorithm defined for CAs since it isn't a CA To match Boulder's CAA enforcement you need to manually drive UnboundTest to do a series of queries the same way that Boulder does. E.g. one for theworkflowexpert.inmotionnow.com and then one for inmotionnow.com.
To match Boulder's CAA enforcement you need to manually drive UnboundTest to do a series of queries the same way that Boulder does. E.g. one for