The —dry-run certbot command uses staging, which will have a different account, which is why your CAA record blocks it.
7 Likes
The —dry-run certbot command uses staging, which will have a different account, which is why your CAA record blocks it.