# CAA DNS Issuer-Critical Flags Are Confusing to Configure

DevFeed: [CAA DNS Issuer-Critical Flags Are Confusing to Configure](<https://devfeed.tech/articles/a-bit-of-dns-28502.md>)

Original publisher: [Read original article](<https://thedailywtf.com/articles/a-bit-of-dns>)

Author: Remy Porter

Published: 2026-09-10T06:30:00Z

Content type: opinion

Language: en

Sources: [The Daily WTF](<https://devfeed.tech/sources/the-daily-wtf.md>)

Topics: [certificates](<https://devfeed.tech/topics/certificates.md>), [domain](<https://devfeed.tech/topics/domain.md>)

Tags: [bits](<https://devfeed.tech/tags/bits.md>), [boolean](<https://devfeed.tech/tags/boolean.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [documentation](<https://devfeed.tech/tags/documentation.md>), [feature-articles](<https://devfeed.tech/tags/feature-articles.md>), [flag](<https://devfeed.tech/tags/flag.md>), [https](<https://devfeed.tech/tags/https.md>), [readability](<https://devfeed.tech/tags/readability.md>)

## AI overview

The article examines confusion around the issuer-critical flag in DNS CAA records. It explains that the flag is defined as a bitmask, while many users interpret the documentation as requiring the integer 1 instead of the value representing the specified bit, creating a dilemma for certificate issuers such as LetsEncrypt.

## Source excerpt

I'm not a DNS person, in that I appreciate that it exists but am not up on the inner workings. It solves a lot of problems with dark magic I don't fully understand, and fortunately don't need to. But Lucio noticed something that I do think is interesting, within the scope of the CAA record type. The CAA record started with RFC6844, which was obsoleted by RFC8659. Both RFCs lay out the same core idea: you can add a CAA record to your DNS entries to say, "hey, this domain over here is allowed to issue certificates for me". That's the sort of thing that enables LetsEncrypt to hand out certs, and is an important part of why we can run HTTPS everywhere these days. Now, RFC6844 has this in it: Issuer Critical: If set to '1', indicates that the corresponding property tag MUST be understood if the semantics of the CAA record are to be correctly interpreted by an issuer. Issuers MUST NOT issue certificates for a domain if the relevant CAA Resource Record set contains unknown property tags that have the Critical bit set. The issuer critical flag means that the certificate issuer needs to validate your CAA record before it issues a certificate for you. There's more in the RFC about what exactly that means, but we don't care about those details for right now. The rule here is "set a flag to 1". A little later in the RFC, the flag is described in more detail- as a bitmask. Specifically, bit 0 is the issuer critical flag. Bits 1-7 are reserved for future use. Now, here's where we get into trouble, because programmers don't understand bits, and because the CAA record expects you to put an integer in this field. So, if you want issuer critical enabled, what value to you put in this field? 128, obviously. That's 10000000. Except, if you don't understand bits, that's not obvious. A lot of people read this and decided that the documentation meant they needed to put 1 in the field- aka 00000001. This is wrong. The updated RFC tries to explain it a bit more clearly: Bit 0, Issuer Critic