[Maarten Van Horenbeeck] [Information Security] [Resources]

Certification Authority Authorization Records

RFC 6844 describes Certification Authority Authorization Records, a mechanism for domain name owners to signal which Certificate Authorities are authorized to issue certificates for their domain. When a CAA record is defined for a particular domain, it specifies that the domain owner requests Certificate Authorities to validate any request against the CAA record. If the certificate issuer is not listed in the CAA record, it should not issue the certificate.

The RFC also permits Certificate Evaluators to test an issued certificate against the CAA record, but should exercise caution, as the CAA record may change during the lifetime of a certificate, without affecting its validity.

CAA also supports an iodef property type which can be requested by a Certificate Authority to report certificate issue requests which are inconsistent with the issuer's Certificate Policy.

Configuration of CAA records

BIND supports CAA records as of version 9.9.6.

A CAA record can be configured by adding it to the zone file:

$ORIGIN example.com
CAA 0 issue "ca1.example"
CAA 0 iodef "mailto:security@example.com"

If your organization uses multiple CA's, you can configure multiple records:

CAA 0 issue "ca1.example"
CAA 0 issue "ca2.example"

"ca1.example" and "ca2.example" are unique identifiers for the CA you plan on using. These strings can be obtained from your Certificate Authority, and typically are its top level domain. An example is "letsencrypt.org" for the Let's Encrypt CA operated by the Internet Security Research Group.

Knot-DNS supports CAA records as of version 2.2.0.

Validation of CAA records

Once a CAA record is deployed, it can be validated using the following dig query:

user@system:~$ dig CAA google.com
; <<>> DiG 9.10.3-P4-Debian <<>> CAA google.com
google.com. 3600 IN CAA 0 issue "symantec.com"

On older versions of Dig, which do not support CAA records, you can query the record type manually:

dig +short -t TYPE257 google.com
\# 19 0005697373756573796D616E7465632E636F6D