CAA 记录
Certificate Authority Authorization — declares which CAs are allowed to issue certs for your domain.
CAA 记录是什么？
CAA (RFC 6844, updated by RFC 8659) is a guard rail: it tells public CAs which authorities may issue TLS certificates for your domain. Modern CAs must check CAA before issuance — a misconfigured CAA blocks renewal.
区域文件示例
example.com. 300 IN CAA 0 issue "letsencrypt.org" example.com. 300 IN CAA 0 iodef "mailto:security@example.com"
常见用例
- ▸Lock issuance to a single CA (Let's Encrypt, DigiCert, etc.).
- ▸Get notified when an unauthorised issuance is attempted via the iodef tag.
- ▸Tighten a regulated environment where rogue cert issuance is a compliance risk.
- ▸Allow wildcard issuance separately via the issuewild tag.
常见坑
Letting CAA expire or pointing it at a CA you no longer use will silently fail certificate renewal. Always test with Let's Encrypt staging or a CAA lint tool before tightening.