How mandatory is that CAA record for chatmail relays?

[esbeeb]

I’ve set up my first chatmail server on an available domain I own. For the sake of example, let’s pretend it’s example.com

It’s a VPS running Debian 12. I created all the DNS records it asked. It creates a CAA record looking like:

example.com. 3600 IN CAA 0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890"

I was using several subdomains for other projects, say othersite1.example.com, and othersite2.example.com

These are on other VPS with different IP addresses, and they had their own respective Let’s Encrypt SSL certs.

But now as I understand, that CAA record above sort of monopolizes the entire example.com domain, for getting Let’s Encrypt SSL certs! My SSL certs for othersite1.example.com, and othersite2.example.com will eventually expire, and I won’t be able to renew them!

Can I just stop hosting the CAA record, to release the “exclusive lock” (as it were) on my VPS’ static IP addresses (IP4 and IP6), used by the chatmail relay, for obtaining Let’s Encrypt SSL certs?

I didn’t realize I had to “give up” all that domain to my chatmail relay, so to speak.

[link2xt]

Similar question is already answered here and there are more topics if you search for “CAA”:

The accounturi parameter at Chatmail server DNS records

CAA record is not very important, you can skip adding it if it’s impossible. But may be better to switch to another DNS server in any case because there is no reason for not being able to setup CAA records. If DNS provider cannot provide an interface to add CAA records they likely don’t care much about their DNS service. For the reasons to add CAA records you can read

You can remove CAA record, but it’s better to instead set up CAA records for subdomains. Subdomain CAA records override the top level CAA records: RFC 8657: Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding | RFC Editor

[esbeeb]

I did a search before posting, but couldn’t recognize that answer.

OK, so I can also create CAA records for othersite1.example.com, and othersite2.example.com, and then Let’s Encrypt will be happy again for renewing those subdomains?

[link2xt]

Assuming subdomains fail to renew because you use different account numbers, adding CAA records for subdomains with correct account numbers should work.