CAA record
Declares which certificate authorities are allowed to issue certificates for the domain. Authorities are required to check it.
What one looks like
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
Things worth knowing
- With no CAA record, any public authority may issue for your domain.
- Add every authority you actually use, or issuance will start failing.
- An iodef entry gives authorities somewhere to report violations.
Look up a real CAA record
Query any domain live and see every record type with its TTL.