CAA record
A CAA (Certification Authority Authorization) record is a DNS entry that specifies which certificate authorities are permitted to issue TLS/SSL certificates for a domain. Without one, any publicly trusted CA can issue a certificate for the domain if it passes that CA's own validation; with a CAA record in place, CAs are required by the CA/Browser Forum baseline requirements to check it and refuse to issue a certificate if they aren't on the allowed list. It's a defense-in-depth control against a certificate being mistakenly or maliciously issued by an unintended CA, and it costs nothing to add beyond a single DNS record.
By AdminKit team, Netbase JSC · Updated