The Certification Authority Authorization (CAA) DNS Resource Record allows a DNS domain name holder to specify one or more Certification Authorities (CAs) authorized to issue certificates for that domain.
CAA Resource Records allow a public Certification Authority to implement additional controls to reduce the risk of unintended certificate mis-issue.
Example CAA records:
example.com. 21050 IN CAA 0 issue "sectigo.com"
example.com. 21050 IN CAA 0 issuewild "sectigo.com"
example.com. 21050 IN CAA 0 issue "digicert.com"
example.com. 21050 IN CAA 0 issuewild "digicert.com"
IMPORTANT: The CA does not automatically recheck the CAA records after a "Pre-Sign Failed" error. Please first correct the CAA records and then contact our support so we can request a recheck with the CA.
This document defines the syntax of the CAA record and rules for processing CAA records by certificate issuers.
Show details in RFC 6844:
https://tools.ietf.org/html/rfc6844
