CAA 레코드
Certificate Authority Authorization — declares which CAs are allowed to issue certs for your domain.
CAA 레코드란?
CAA (RFC 6844, updated by RFC 8659) is a guard rail: it tells public CAs which authorities may issue TLS certificates for your domain. Modern CAs must check CAA before issuance — a misconfigured CAA blocks renewal.
영역 파일 예시
example.com. 300 IN CAA 0 issue "letsencrypt.org" example.com. 300 IN CAA 0 iodef "mailto:security@example.com"
일반적인 사용 사례
- ▸Lock issuance to a single CA (Let's Encrypt, DigiCert, etc.).
- ▸Get notified when an unauthorised issuance is attempted via the iodef tag.
- ▸Tighten a regulated environment where rogue cert issuance is a compliance risk.
- ▸Allow wildcard issuance separately via the issuewild tag.
흔한 실수
Letting CAA expire or pointing it at a CA you no longer use will silently fail certificate renewal. Always test with Let's Encrypt staging or a CAA lint tool before tightening.