DNS Record Explainer

This is a CAA (Certification Authority Authorization) record. It has three components:

• Flags: 0 — standard issuance. A value of 128 would mark it critical (CAs must reject if they don't understand it); 0 means non-critical.

• Tag: issue — controls which CAs can issue SSL/TLS certificates for this domain. The "issue" tag specifically permits certificate issuance.

• Value: letsencrypt.org — names the CA allowed to issue. This grants Let's Encrypt permission to validate and sign certs.

In practice: a client (like your domain registrar or DNS provider) will check CAA before issuing a cert. If your domain has this record and someone requests a cert from DigiCert, that request should fail because DigiCert isn't listed. Let's Encrypt will succeed because it's explicitly authorized.

• Incomplete policy — this record only permits Let's Encrypt. If you need certs from other CAs (commercial providers, internal PKI, backup issuers), you'll need additional CAA records with the same or different tags. Add them as separate records with the same domain name.

• No wildcard or issuewild — you haven't restricted who can issue wildcard certs (*.yourdomain.com). Consider adding an issuewild tag if you want different rules for wildcards. Without it, the "issue" rule doesn't apply to wildcards—that's a footgun in older setups.

• No iodef — no reporting mechanism configured. If a CA rejects a request due to CAA, you won't be notified. Optional, but useful for spotting unauthorized issuance attempts.

CAA is your primary defense against misissued certificates. An attacker who can't modify your DNS can't trick a CA-compliant issuer into signing a cert for your domain. This matters most if you're at risk of DNS hijacking, compromised registrar accounts, or targeted phishing of CAs. Without CAA, any CA can issue for you if they're duped. With it, you've narrowed the attack surface to just the CAs you trust.