CAA record
The DNS record naming which certificate authorities may issue certificates for a domain; authorities must check it before issuing.
What it means
CAA (RFC 8659) lets a domain restrict certificate issuance. A record such as 0 issue "letsencrypt.org" allows only that authority; issuewild controls wildcard certificates; iodef gives a contact for reports of refused requests. Certificate authorities must check CAA before issuing, and the closest record up the name tree applies.
For mail, it matters when a certificate is needed and does not arrive. An MTA-STS policy host (mta-sts.example.com) or a mail server needs a valid certificate, and a CAA record that forgets your provider's authority makes issuance or renewal fail.
A domain with no CAA records allows any authority.
Example
example.com. 3600 IN CAA 0 issue "letsencrypt.org"Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes