DNS CAA Record

A DNS Certification Authority Authorization (CAA) record lets a domain holder specify which certificate authorities (CAs) are permitted to issue certain publicly trusted TLS certificates for that DNS name. Under RFC 8659, the 'issue' property authorizes issuers for ordinary certificates, while 'issuewild' can separately restrict wildcard certificate issuance; an 'iodef' property can describe a reporting destination. A compliant public CA checks the applicable CAA records before issuing a certificate, but a CAA record is not itself a certificate and is not checked by visitors' browsers to validate an existing certificate. CAA settings can reduce some risks of unintended certificate issuance, but they cannot prevent every type of compromise or certificate mis-issuance. Overly restrictive or outdated records may prevent a legitimate certificate from being issued or renewed. Check the current certificate provider's instructions and test changes carefully before updating DNS.