CAA record prevents issuance

No, actually the other way around. The --dry-run would have failed if "issue" was wrong.

An "issue" allows discrete names and wildcard names. An "issuewild" is only for wildcard.

4 Likes