Query timed out looking up CAA for another subdomain

Yes, that's possible, although the most common case is that a good DNS provider provides a correct DNS protocol error when a CAA record is missing. According to the CAA specs, this counts as no CAA record, which is fine.

I think there's a subtlety here about DNS provider software that doesn't realize it's authoritative for an intermediate level subdomain when there are no records at that level, or something. Perhaps the implementers thought "if there are no records at this level, we never need to return anything in response to queries for them" or something? But as you can see in the documentation above, Let's Encrypt insists on actively getting a reply indicating that the record is nonexistent, which was lacking in this case for some reason.

1 Like