CAA Records Constraining Certificates
A Certification Authority Authorization record names which certificate authorities may issue certificates for a domain, giving owners a hard limit backed by CA enforcement.
Definition
CAA is a DNS record type that lists the certification authorities permitted to issue certificates for a domain and its subdomains, a constraint that complying authorities must check before issuance.
Context and scope
It reduces the risk of a mis-issued certificate from a rogue or compromised CA by shrinking the set of authorities that will even attempt issuance.
Common misconceptions
- CAA records cannot be bypassed by a malicious CA
- a CAA record encrypts or protects the domain's DNS traffic
Anti-patterns
- setting a CAA record that excludes a CA the team actually uses
- forgetting to cover subdomains that are issued independently
Related concepts
Authoritative source
Definition
CAA is a DNS record type that lists the certification authorities permitted to issue certificates for a domain and its subdomains, a constraint that complying authorities must check before issuance.
It reduces the risk of a mis-issued certificate from a rogue or compromised CA by shrinking the set of authorities that will even attempt issuance. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.
When to use it
A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.
How it works
The issue and issuewild properties restrict standard and wildcard issuance, and an iodef property supplies a contact URL for reporting failed or suspicious requests.
A non-compliant CA can still issue a certificate, so CAA is a policy control that works in concert with certificate transparency monitoring rather than a cryptographic guarantee.
Trade-offs and alternatives
Publish CAA records for every DNS name that certificate automation touches, and validate them after DNS migrations because a lost record silently reopens issuance to all authorities. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.
Common misconceptions
A persistent misconception is that CAA records cannot be bypassed by a malicious CA. Another is that a CAA record encrypts or protects the domain’s DNS traffic. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.
Anti-patterns to avoid
Two recurring anti-patterns are to setting a CAA record that excludes a CA the team actually uses and to forgetting to cover subdomains that are issued independently. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include Equal-Cost Multipath Routing, TCP Zero Window and Flow Control, MIME Type Sniffing and nosniff.