DNS CAA record

A CAA record has a flag, a tag and a value. The common tag is `issue`, whose value is the domain name identifying an authority — for example `issue "letsencrypt.org"`.

`issuewild` restricts wildcard certificates specifically, which is worth separating because a wildcard covers every subdomain at once.

`iodef` gives a contact address — a mailto or a URL — where an authority may report a refused request. It is optional and rarely acted on.

A critical flag of 128 on a tag an authority does not understand requires that authority to refuse issuance rather than proceed, which is how unknown extensions fail safe.

The rule is part of the CA/Browser Forum baseline requirements, so it applies to every authority in the public trust stores rather than being voluntary.

Lookup climbs the tree: an authority checking `shop.example.com` looks there, then at `example.com`, and uses the first record set it finds. A record at the apex therefore covers subdomains that have none of their own.

No record at all means no restriction. The absence is permission, not refusal, which is the opposite of how most access control reads.

The check happens at issuance time only. Certificates already issued are unaffected by a record added afterwards.

It reduces the attack surface of mis-issuance: an authority tricked into issuing for your domain must first be one you authorised, or it must ignore its own baseline requirements.

It does nothing against someone who controls your DNS, because they can simply change the record. CAA assumes the zone is yours.

It does nothing about certificates already in circulation, and it is not a revocation mechanism.

Certificate Transparency logs are the complementary control: CAA limits who may issue, Certificate Transparency makes what was issued visible after the fact.

`dig example.com CAA +short` prints the records. An empty answer means no restriction is published.

List every authority you actually use before publishing, including the one behind your CDN and any hosting platform that provisions certificates automatically. Omitting one breaks renewal, usually weeks later.

Add the record and then renew a certificate deliberately, rather than waiting for the automatic renewal to discover the mistake at the moment the current certificate expires.

Review it when you change CDN, hosting or certificate provider. It is exactly the kind of record nobody remembers exists.