(using them can help protect your domain)<\/strong><\/p>\n As most DDI (DNS, DHCP, IPAM) administrators know by now, a CAA RR (Resource Record) is a DNS record that you, as a domain owner, can enter into your DNS server to help prevent unauthorized CAs (Certificate Authorities) from issuing a certificate for your domain.\u00a0 There is a common misconception a requirement exists to enter a CAA record into your DNS server if you want to purchase a certificate, but this is not the case.\u00a0 There is a requirement, but it applies to CAs, not DNS administrators.\u00a0 This requirement, effective September 2017, requires CAs to query for a CAA record in the authoritative zone for which the certificate is being requested.\u00a0 The CAA record contains (among other things) a list of the CAs that are allowed to issue a certificate for the domain (zone) it is in.\u00a0 If the requesting CA is not listed, the certificate will not be issued.<\/p>\n For example, if you own the domain \u201cmydomain.com\u201d, you probably also have an authoritative DNS zone that holds all the records for that zone.\u00a0\u00a0 If this zone is publicly available, you might want to obtain a certificate for it, so you can encrypt traffic.\u00a0 In this example, let\u2019s say you obtain your certificates from \u201cEncryptMe\u201d.\u00a0 You would then create a CAA record, and specify that only \u201cencryptme.com\u201d is allowed to issue certificates for \u201cmydomain.com\u201d.\u00a0 In the CAA record, you can (should) also specify where to send a notification if a CA other than EncryptMe has been asked to issue a certificate.<\/p>\n Using CAA records adds another layer of protection for your organization by limiting which CAs can issue a certificate for your domain.\u00a0\u00a0 CAA records can also contain information that tells the requesting CA how to contact the domain holder when a certificate is issued, or if the policy in the CAA record is violated.\u00a0 For example, if an unlisted CA has been asked to issue your certificate, the CA won\u2019t issue it.\u00a0 Basically, you will have much tighter control on how and when your certificates are issued.\u00a0 An unauthorized certificate request isn\u2019t necessarily malicious, by the way.\u00a0 You might have a user innocently attempt to buy a certificate from a different CA than the one you normally use.\u00a0 Having a CAA record prevents this from happening.\u00a0 You can even prevent certificates from being issued at all.\u00a0 And remember CAA records cost you nothing \u2013 they are simply resource records in a zone.\u00a0 Use them!<\/p>\nWhat is a CAA (Certification Authority Authorization) Resource Record?<\/h2>\n
Why should you use a CAA Resource Record?<\/h2>\n