CAA records: decide who may issue certificates for you

Any public certificate authority (CA) can in principle issue a certificate for any domain. That's convenient — but also a risk: if a CA is tricked or compromised, someone could obtain a valid certificate for your domain and impersonate you. The CAA record closes that door a good deal.

What CAA does

CAA (Certification Authority Authorization) is a DNS record in which you list which CAs are allowed to issue certificates for your domain at all. Reputable CAs are required to check this record before issuing — if their identifier isn't listed, they refuse.

An example

A CAA record might say: "Only the CA myca.example may issue certificates for this domain." If another CA tries, it must decline. That shrinks the attack surface from "every CA in the world" to "exactly the one I use".

What to watch

• Wildcards controlled separately: you can allow normal and wildcard certificates differently.
• Reporting address (iodef): optionally publish a contact address for CAs to report violations to.
• Don't forget when switching CA: if you change CA, update the CAA record — otherwise the next issuance fails.

CAA doesn't replace the other layers of protection, but it's a cheap, effective bolt against mis-issued certificates — one DNS record, a lot gained.