Here is a security control with a property almost nothing else in web security has: the hard part is already done, universally, by mandate.
Since September 8, 2017, every certificate authority in the CA/Browser Forum’s Baseline Requirements has been required to check CAA records before issuing a certificate. Not encouraged. Required. Ballot 187 passed 19-to-1 among the CAs voting, with all three participating browsers in favor, and it turned CAA checking from a nice idea into a compliance obligation. A public CA that issues a certificate in violation of a domain’s CAA record is committing a misissuance, and misissuance is how CAs get distrusted and go out of business.
So the enforcement machinery is live, global, and backed by the only threat CAs actually fear. All you have to do to use it is publish one DNS record.
Almost nobody does.
As of mid-2024, Qualys data put CAA adoption at 15.4% of the top 150,000 TLS-supporting sites. A CSC report the same year found just 9.5% of the Forbes Global 2000 — the two thousand largest companies on the planet, the ones with security budgets — had CAA records at all. Go back to December 2017, right after checking became mandatory, and Scott Helme’s daily scan of the Alexa top million found about 3,400 sites with CAA. The curve since then slopes gently up and to the right, and it is nowhere near where it should be for something this cheap.
What the record actually does
A CAA record is a list of which certificate authorities are allowed to issue for your domain. That’s the whole idea. One line:
example.com. CAA 0 issue "letsencrypt.org"That says: the only CA permitted to issue certificates for example.com is Let’s Encrypt. Any compliant CA that receives a request for a certificate on your domain — from anyone — is obligated to look up your CAA record, see that it isn’t listed, and refuse. You can list several. You can add issuewild to control wildcards separately. You can set 0 issue ";" to say no CA may issue, which is a clean way to lock down a domain that should never have a public certificate.
Think about what that changes. Without CAA, the set of authorities that can mint a valid certificate for your domain is all of them — every public CA in every root store, any one of which issuing for your name produces a certificate browsers accept. With a CAA record, you’ve shrunk that set to the one or two CAs you actually use. You haven’t made misissuance impossible, but you’ve cut the attack surface from ~150 authorities down to the handful you chose, and you’ve made a whole class of careless or automated misissuance flatly non-compliant.
RFC 6844 defined this back in 2013. RFC 8659 replaced it in 2019, mostly to fix an over-complicated tree-climbing algorithm that made the DNS lookups inefficient. The standard is mature. The tooling is trivial — it’s a DNS record, the same as adding a TXT record for SPF. There is no cost. There is no vendor. There is no annual fee. And the industry, collectively, shrugged.
Why the number stays low
I’ve thought about this more than is healthy, and I don’t think it’s laziness exactly. It’s that CAA sits in a dead zone of incentives.
It’s invisible when it works. SPF, DKIM, DMARC at least have a feedback loop — your mail bounces, someone complains, you fix the record. CAA does nothing you can see. You publish it and… your site works exactly as before. The only time it matters is the day some CA almost issues a certificate it shouldn’t, and you will never know that happened, because the whole point is that it silently didn’t. A control whose success is indistinguishable from doing nothing is a hard sell to a busy team.
And there’s a real, non-trivial fear underneath: get it wrong and you break your own certificate renewals. Put the wrong CA in the record, or forget to add the new one when you migrate providers, and your own ACME client starts failing issuance. For a lot of teams the mental math is “downside: I lock myself out; upside: I’m protected against a threat I’ve never personally experienced.” That math loses, every time, until it doesn’t.
The honest limits
I’m not going to oversell this, because the reason CAA is worth setting is also the reason it’s not a silver bullet.
CAA is advisory to compliant CAs. It is not enforced by the browser — your visitor’s Chrome does not check your CAA record before trusting a certificate, and it can’t, because by the time a cert is presented the issuance already happened. So a CA that is compromised, coerced, or simply ignoring the rules can issue against your CAA record, and the certificate will still be trusted by clients. CAA raises the cost and closes the accidental paths; it does not stop a determined rogue authority. That job belongs to Certificate Transparency and to the root programs’ willingness to execute CAs that misbehave.
There’s a second gap. CAA lives in DNS, and the CA checks it at issuance time. If an attacker can spoof your DNS at that moment — suppress the record, or forge a permissive one — the check passes on a lie. RFC 8659 tells CAs to prefer DNSSEC-validated answers for exactly this reason, but plenty of domains don’t sign their zones, so the protection is only as strong as the DNS underneath it. CAA assumes your DNS is trustworthy. For a lot of the web, that assumption is doing heavy lifting.
So no, one line of DNS does not make you immune to certificate attacks. What it does is take the “any of 150 CAs” problem — which is a genuinely absurd default — and narrow it to the ones you deliberately trust, for free, honored by mandate, in about the time it takes to add a DNS record. The refinements exist too, if you want them: RFC 8657 added accounturi and validationmethods, so you can pin issuance not just to a CA but to a specific ACME account and a specific challenge type. Almost nobody uses those either.
The part that bothers me
Most security advice is a fight against physics or economics. “Adopt DNSSEC” runs into brittle key management and registrar support that ranges from bad to nonexistent. “Deploy MTA-STS” asks you to stand up a policy endpoint. “Rotate your certificates faster” means more automation to build. These are real costs, and low adoption at least makes sense.
CAA has none of that. The expensive part — getting every CA on Earth to honor the record — was solved by committee vote in 2017 and has been quietly running ever since. The cheap part, the one thing left for domain owners to do, is publish a single line. And nine years in, six domains out of seven haven’t bothered.
It’s the rare case where the standards process did its job, the CAs did their job, and the last mile — the easy mile — is the one that didn’t get walked. If you run a domain and you take five minutes this week, you’ll be in the 15% that did.