[Maarten Van Horenbeeck] [Information Security] [Resources]
Certification Authority Authorization Records
RFC 6844 describes Certification Authority Authorization Records, a mechanism for domain name owners to
signal which Certificate Authorities are authorized to issue certificates for their domain.
When a CAA record is defined for a particular domain, it specifies that the domain owner requests
Certificate Authorities to validate any request against the CAA record. If the certificate issuer is not
listed in the CAA record, it should not issue the certificate.
The RFC also permits Certificate Evaluators to test an issued certificate against the CAA record, but
should exercise caution, as the CAA record may change during the lifetime of a certificate, without
affecting its validity.
CAA also supports an iodef property type which can be requested by a Certificate Authority to
report certificate issue requests which are inconsistent with the issuer's Certificate Policy.
Configuration of CAA records
BIND supports CAA records as of version 9.9.6.
A CAA record can be configured by adding it to the zone file:
$ORIGIN example.com
CAA 0 issue "ca1.example"
CAA 0 iodef "mailto:security@example.com"
If your organization uses multiple CA's, you can configure multiple records:
CAA 0 issue "ca1.example"
CAA 0 issue "ca2.example"
"ca1.example" and "ca2.example" are unique identifiers for the CA you plan on using. These strings
can be obtained from your Certificate Authority, and typically are its top level domain. An example
is "letsencrypt.org" for the Let's Encrypt CA operated by the Internet Security Research Group.
Knot-DNS supports CAA records as of version 2.2.0.
Validation of CAA records
Once a CAA record is deployed, it can be validated using the following dig query:
user@system:~$ dig CAA google.com
; <<>> DiG 9.10.3-P4-Debian <<>> CAA google.com
;; ANSWER SECTION;
google.com. 3600 IN CAA 0 issue "symantec.com"
On older versions of Dig, which do not support CAA records, you can query the record type
manually:
dig +short -t TYPE257 google.com
\# 19 0005697373756573796D616E7465632E636F6D