Record CAA
Certificate Authority Authorization — declares which CAs are allowed to issue certs for your domain.
Cos'è un record CAA?
CAA (RFC 6844, updated by RFC 8659) is a guard rail: it tells public CAs which authorities may issue TLS certificates for your domain. Modern CAs must check CAA before issuance — a misconfigured CAA blocks renewal.
Esempio di zone file
example.com. 300 IN CAA 0 issue "letsencrypt.org" example.com. 300 IN CAA 0 iodef "mailto:security@example.com"
Casi d'uso comuni
- ▸Lock issuance to a single CA (Let's Encrypt, DigiCert, etc.).
- ▸Get notified when an unauthorised issuance is attempted via the iodef tag.
- ▸Tighten a regulated environment where rogue cert issuance is a compliance risk.
- ▸Allow wildcard issuance separately via the issuewild tag.
Trappole comuni
Letting CAA expire or pointing it at a CA you no longer use will silently fail certificate renewal. Always test with Let's Encrypt staging or a CAA lint tool before tightening.