CAA_POLICY_FROM_ANCESTOR

info

The CAA policy for this name is published on a parent domain, so changing it may not be within your control.

An observation. Whether it matters depends on what the domain is for.

How we know

caa.test
Tree climbing and property semantics. deep.nested climbs two labels to the apex; sub publishes its own policy that must not be merged with the apex's; split has different CAs for issue and issuewild; critical carries an unknown property with the critical bit, which blocks issuance despite also naming a CA.