> you can prevent this by setting CAA DNS records on your own domain Well this is interesting, I already have a CAA DNS record on my root domain, but of course

> you can prevent this by setting CAA DNS records on your own domain Well this is interesting, I already have a CAA DNS record on my root domain, but of course its also set to 'letsencrypt.org' since that is what I use on my root domain. Although I don't guess it matters since its on the root and not the subdomain Edit: Actually, looks like a CAA record on the root domain will also limit subdomains. So, although I already had a CAA record setup, looks like this new Github feature will work as expected when it rolls out to my account without any changes since I was already using letsencrypt