Unable to renew/issue Let's Encrypt certificate: CAA record for example.com prevents issuance

Symptoms

• Unable to renew/issue Let's Encrypt certificate:

  PLESK_ERROR: CAA record for example.com prevents issuance

• Checking CAA record for example.com returns the following:

  # dig caa example.com +short
  0 issue "example.com"

Cause

DNS record for certification authority does not allow to issue Let's Encrypt certificate.

Resolution

1. Log into Plesk.
2. Open Domains > example.com > DNS Settings > select CAA record and delete it using Remove button.
3. Press Update to save changes: