CAA

Any public certificate authority will issue a certificate for your domain to whoever convinces it they control the domain. There are hundreds of authorities, and an attacker only needs to fool the weakest one: through a hijacked mail address, a poisoned DNS answer during validation, or a flaw in that authority's checks. A CAA record is a short list in DNS that says which authorities you actually use. Authorities are required to read it before issuing, and to refuse if they are not on it.

CAA does not stop an attacker who has taken over your DNS, because they can edit the record too, and it does not protect against a compromise of an authority you do allow. What it does is shrink the number of organisations whose mistakes can hurt you from hundreds to one or two, for the price of a single DNS record.

The record

CAA records are published at the domain apex. A typical setup allows one authority and asks for a report if anyone else is refused:

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:security@example.com"

• •issue — authorises a named authority to issue ordinary certificates. Use one record per authority.
• •issuewild — the same, but for wildcard certificates (*.example.com). If absent, issue applies to wildcards as well.
• •iodef — an address or URL where an authority can report a refused request. Optional, and not every authority sends these.
• •issue ";" — an empty value forbids all issuance, which is the right setting for a domain that should never have a certificate.

Authorities look for CAA at the exact name being certified, then walk up the tree until they find a record. So a record at example.com covers www.example.com and every other subdomain unless that subdomain publishes its own.

Common failure modes

• •No CAA record at all — every authority is allowed. This is the default, and what Surface reports.
• •Forgetting an authority you rely on indirectly. CDNs, managed hosting and website builders often obtain and renew certificates for you, sometimes from more than one authority. If their authority is missing, the next renewal fails and the site shows an expired certificate. Check who issues your current certificate, and ask your providers, before publishing CAA.
• •Publishing CAA at the apex but a subdomain points to a third party that uses a different authority, with its own CAA record that nobody owns.
• •Treating CAA as the whole defence. It works alongside certificate transparency monitoring, which tells you when a certificate you did not request is issued.