概念概述
CAA 记录约束证书签发（CAA Records Constraining Certificates）指的是：证书颁发机构授权记录列出可为某域名签发证书的 CA，为域名所有者提供由合规 CA 强制执行的硬性限制，降低误签发风险。
从更严格的定义看，CAA is a DNS record type that lists the certification authorities permitted to issue certificates for a domain and its subdomains, a constraint that complying authorities must check before issuance. 该概念在工程实践中的价值，在于它能帮助团队用统一的语言描述一个具体的质量属性或设计约束，从而在评审与协作中减少歧义。
为什么需要它
It reduces the risk of a mis-issued certificate from a rogue or compromised CA by shrinking the set of authorities that will even attempt issuance. 它与 Equal-Cost Multipath Routing、TCP Zero Window and Flow Control、MIME Type Sniffing and nosniff 等概念经常一起出现，用于解决相近的工程问题。理解它的适用场景，有助于在多种备选方案之间做出有依据的取舍，而不是凭直觉选择技术方案。
常见误解
- CAA records cannot be bypassed by a malicious CA
- a CAA record encrypts or protects the domain’s DNS traffic
需要避免的反模式
- setting a CAA record that excludes a CA the team actually uses
- forgetting to cover subdomains that are issued independently
实践要点
- The issue and issuewild properties restrict standard and wildcard issuance, and an iodef property supplies a contact URL for reporting failed or suspicious requests.
- A non-compliant CA can still issue a certificate, so CAA is a policy control that works in concert with certificate transparency monitoring rather than a cryptographic guarantee.
- Publish CAA records for every DNS name that certificate automation touches, and validate them after DNS migrations because a lost record silently reopens issuance to all authorities.