DNS Record Explainer

This is a CAA (Certification Authority Authorization) record missing its domain name prefix. The complete form should be:

example.com. 3600 IN CAA 0 issue "letsencrypt.org"

Breaking down each part:
• 0 — flags field. 0 means no special handling. (128 would set the critical bit, forcing non-compliant resolvers to reject the record.)
• issue — tag. Permits the named CA to issue certificates for this domain.
• "letsencrypt.org" — value. The CA authorized to issue. This is the issuer domain, not a full URL.

What this does in practice: CAs query CAA records before issuing certificates. This record tells them "only Let's Encrypt can issue for my domain." Requests from other CAs (DigiCert, Sectigo, etc.) will be denied if they respect CAA validation.

• Record is incomplete as pasted — missing the domain name and TTL. You need at least `example.com. IN CAA 0 issue "letsencrypt.org"` to be valid.
• The value "letsencrypt.org" is correct for Let's Encrypt. Some older docs show "letsencrypt.org;" (with semicolon) — that's wrong. Use the domain without trailing punctuation inside quotes.
• No wildcard CA specified. If you issue certificates for subdomains via a different CA, add a second CAA record: `0 issue "other-ca.com"`. Without it, those CAs can't issue.
• No iodef tag for incident reporting. Consider adding `0 iodef "mailto:[email protected]"` on the same domain so CAs can report unauthorized requests.
• Let's Encrypt respects CAA; most commercial CAs do too. Some legacy or internal CAs ignore it — this record won't block them.

CAA records are a DNS-level gatekeeper. They prevent certificate mis-issuance if a CA's validation is compromised or if you accidentally authorize the wrong issuer. Without CAA, any CA can theoretically issue a cert for your domain if they can prove domain control (email, DNS challenge, etc.). With CAA set to only Let's Encrypt, requests to other CAs fail immediately at the CAA check, before they waste time on validation.