Rekord CAA

Certificate Authority Authorization — declares which CAs are allowed to issue certs for your domain.

Czym jest rekord CAA?

CAA (RFC 6844, updated by RFC 8659) is a guard rail: it tells public CAs which authorities may issue TLS certificates for your domain. Modern CAs must check CAA before issuance — a misconfigured CAA blocks renewal.

Przykładowy wpis pliku strefy

example.com.    300    IN    CAA    0 issue "letsencrypt.org"
example.com.    300    IN    CAA    0 iodef "mailto:security@example.com"

Typowe zastosowania

▸Lock issuance to a single CA (Let's Encrypt, DigiCert, etc.).
▸Get notified when an unauthorised issuance is attempted via the iodef tag.
▸Tighten a regulated environment where rogue cert issuance is a compliance risk.
▸Allow wildcard issuance separately via the issuewild tag.

Typowe pułapki

Letting CAA expire or pointing it at a CA you no longer use will silently fail certificate renewal. Always test with Let's Encrypt staging or a CAA lint tool before tightening.

Sprawdź rekordy DNS →

Powiązane typy rekordów

A record

Maps a domain name to an IPv4 address.

AAAA record

Maps a domain name to an IPv6 address.

MX record

Tells the world which mail servers receive email for a domain.

TXT record

Stores arbitrary text — most often SPF, DKIM, DMARC and ownership-verification tokens.