NEWRFC 10023 and the _for-sale TXT record: what it means for DNS security Sponsored by

NEWRFC 10023 and the _for-sale TXT record: what it means for DNS security

Missing CAA Record

Certificate Authority Authorization missing from DNS

Warning

Certificate Control

SSL/TLS Security

Security Warning

Your domain lacks CAA (Certificate Authority Authorization) records, allowing any certificate authority to issue SSL/TLS certificates for your domain. While this is a best practice recommendation rather than an immediate critical vulnerability, implementing CAA records adds an important layer of defense against potential man-in-the-middle attacks and certificate-based impersonation.

Understanding CAA Protection

CAA (Certificate Authority Authorization) records are DNS records that specify which certificate authorities (CAs) are authorized to issue SSL/TLS certificates for your domain. Without CAA records, any CA in the world can potentially issue valid certificates for your domain, creating significant security risks.

Attackers can exploit missing CAA records by obtaining fraudulent certificates from compromised or malicious certificate authorities, enabling them to intercept and decrypt HTTPS traffic, conduct man-in-the-middle attacks, and impersonate your website with valid-looking SSL certificates.

Attack Impact

The absence of CAA records enables sophisticated attacks including fraudulent certificate issuance for traffic interception, business email compromise through certificate-based impersonation, supply chain attacks targeting partner communications, and reputation damage from successful certificate abuse.

With certificate authority control risks clearly understood, implementing CAA records becomes essential for preventing unauthorized certificate issuance. The following configurations provide comprehensive protection against fraudulent certificates.

CAA Record Implementation

With the security risks clear, implementing CAA records becomes essential for controlling which certificate authorities can issue certificates for your domain.

Basic CAA Record Configuration

Implement CAA records to establish granular control over certificate issuance, creating a powerful security layer that prevents unauthorized SSL/TLS certificates from being issued for your domain.

CAA records function as a DNS-based policy enforcement mechanism where you explicitly authorize specific certificate authorities to issue certificates for your domain. This creates a cryptographically verifiable whitelist that certificate authorities must check before issuing certificates, effectively blocking fraudulent certificate requests from unauthorized sources. The records support various policies including standard certificates, wildcard certificates, and incident reporting configurations.

Single Certificate Authority Authorization

Start with basic CAA record implementation for a single trusted certificate authority:

# Basic CAA record syntax and single CA authorization
# Format: domain TTL IN CAA flags tag "value"

yourdomain.com. 3600 IN CAA 0 issue "letsencrypt.org"
# Domain: yourdomain.com. (with trailing dot for absolute FQDN)
# TTL: 3600 seconds (1 hour cache time for policy updates)
# Class: IN (Internet class, standard for all DNS records)
# Type: CAA (Certificate Authority Authorization record type)
# Flags: 0 (non-critical, CA may ignore if CAA unsupported)
# Tag: issue (authorizes regular certificate issuance)
# Value: "letsencrypt.org" (specific CA domain identifier)

This basic configuration authorizes only Let's Encrypt to issue certificates for your domain, blocking all other certificate authorities worldwide from issuing valid certificates.

Multiple Certificate Authority Setup

Configure multiple trusted CAs for redundancy and different certificate types:

# Production-ready multi-CA configuration with backup authorities
yourdomain.com. 3600 IN CAA 0 issue "letsencrypt.org"      # Primary: Free automated certificates
yourdomain.com. 3600 IN CAA 0 issue "digicert.com"         # Secondary: Commercial EV certificates
yourdomain.com. 3600 IN CAA 0 issue "amazon.com"           # Tertiary: AWS Certificate Manager
# Each CA serves different purposes:
# - Let's Encrypt: Automated renewal, cost-effective
# - DigiCert: Extended validation, high-assurance certificates
# - Amazon: Integrated with AWS infrastructure, managed renewal

# TTL considerations for production:
# 3600 seconds (1 hour) balances policy enforcement with update flexibility
# Shorter TTLs allow faster emergency policy changes
# Longer TTLs reduce DNS query load but slow policy updates

Multiple CA authorization provides operational flexibility while maintaining security. Each CA can serve different purposes: automated certificates, extended validation, or cloud platform integration.

Wildcard Certificate Control

Implement strict wildcard certificate policies to prevent broad subdomain certificate abuse:

# Wildcard certificate authorization with granular control
yourdomain.com. 3600 IN CAA 0 issuewild ";"                # Deny ALL wildcard certificates
# Empty value (";") creates explicit denial policy
# Prevents *.yourdomain.com certificates from any CA
# Strongest security posture for wildcard prevention

# Alternative: Authorized wildcard CA only
yourdomain.com. 3600 IN CAA 0 issuewild "digicert.com"     # Only DigiCert for wildcards
# Allows wildcard certificates only from specific high-trust CA
# Useful when wildcard certificates are operationally necessary
# Maintains security while enabling legitimate wildcard use

Wildcard certificate policies are critical because *.yourdomain.com certificates can secure any subdomain. Strict issuewild policies prevent attackers from obtaining broad-scope certificates.

Incident Reporting Configuration

Configure automated incident reporting to detect unauthorized certificate issuance attempts:

# Comprehensive incident reporting for CAA violations
yourdomain.com. 3600 IN CAA 0 iodef "mailto:security@yourdomain.com"
# Email-based incident reporting (primary contact method)
# RFC 5070 IODEF format for structured violation reports
# Security team receives immediate alerts for policy violations

yourdomain.com. 3600 IN CAA 0 iodef "https://yourdomain.com/caa-violation"
# HTTP endpoint for programmatic incident handling
# Enables automated processing of violation reports
# Can integrate with SIEM systems and incident response workflows

# Multiple iodef records provide redundancy:
# - Email ensures human notification even during system outages
# - HTTPS endpoint enables automated analysis and response
# - Both methods increase visibility into certificate abuse attempts

Incident reporting provides early warning of certificate abuse attempts. Multiple reporting channels ensure violations are detected even if one notification method fails.

Testing and Emergency Configuration

Use testing configurations for security validation and emergency certificate blocking:

# Security testing configuration (complete certificate blocking)
yourdomain.com. 300 IN CAA 0 issue ";"                     # Block ALL certificate issuance
# Empty value creates comprehensive issuance denial
# TTL=300 (5 minutes) enables rapid policy changes during testing
# Useful for security audits and compromise response

# Emergency response configuration
yourdomain.com. 60 IN CAA 0 issue ";"                      # Emergency certificate freeze
# TTL=60 (1 minute) for immediate policy enforcement
# Rapidly blocks all certificate issuance during security incidents
# Can be deployed immediately upon detecting certificate abuse

Testing configurations validate CAA policy enforcement and provide emergency response capabilities. Short TTLs enable rapid deployment during security incidents.

CAA Record Types and Flags

Understanding CAA record components:

• Flag (0): Standard non-critical flag, CAs must process
• Flag (128): Critical flag, unknown properties cause rejection
• issue: Authorizes certificate issuance for the domain
• issuewild: Authorizes wildcard certificate issuance
• iodef: Specifies incident reporting contact (email/URL)
• contactemail: Contact email for certificate-related issues

Advanced CAA Configurations

Implement sophisticated CAA policies with granular controls for enhanced certificate security and operational flexibility.

Advanced CAA configurations enable fine-grained control over certificate issuance through account-specific authorization, validation method restrictions, and mixed CA policies. These configurations are essential for enterprise environments where different certificate types serve distinct purposes and multiple teams manage various aspects of the certificate infrastructure.

Mixed Certificate Authority Policies

Implement different CA policies for regular certificates versus wildcard certificates:

# Separate CA policies for regular vs wildcard certificates
yourdomain.com. 3600 IN CAA 0 issue "letsencrypt.org"      # Regular certificates: Let's Encrypt
yourdomain.com. 3600 IN CAA 0 issuewild "digicert.com"     # Wildcard certificates: DigiCert only

# This configuration provides:
# - Cost-effective automated certificates for individual subdomains
# - High-assurance commercial wildcard certificates with enhanced validation
# - Reduced attack surface by limiting wildcard certificate authorities
# - Operational flexibility for different certificate use cases

Mixed CA policies allow cost-effective regular certificates while maintaining strict control over powerful wildcard certificates that can secure multiple subdomains.

Account-Specific Authorization

Restrict certificate issuance to specific CA accounts for enhanced security:

# Let's Encrypt account-specific authorization (ACME account binding)
yourdomain.com. 3600 IN CAA 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/12345678"
# accounturi parameter restricts issuance to specific ACME account
# Prevents certificate issuance even with valid domain control
# Essential for preventing certificate hijacking via domain compromise
# Account ID 12345678 represents your organization's specific account

# Alternative account URI format for staging environment
yourdomain.com. 300 IN CAA 0 issue "letsencrypt.org; accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/87654321"
# Staging environment with separate account for testing
# Short TTL (300s) for rapid testing iterations

Account-specific authorization prevents certificate issuance even if an attacker gains domain control, as they would also need access to your specific CA account credentials.

Validation Method Restrictions

Limit certificate validation methods to prevent certain attack vectors:

# Restrict validation methods for enhanced security
yourdomain.com. 3600 IN CAA 0 issue "amazon.com; validationmethods=dns-01"
# validationmethods=dns-01: Only DNS-based domain validation allowed
# Prevents HTTP-01 validation which can be vulnerable to BGP hijacking
# DNS-01 requires direct DNS zone control for validation

# Multiple validation methods (flexibility with security)
yourdomain.com. 3600 IN CAA 0 issue "digicert.com; validationmethods=dns-01,email-01"
# Allows DNS-01 (preferred) and email-01 validation methods
# email-01: Validation via administrative email addresses
# Excludes HTTP-01 validation to prevent web-based attacks

Validation method restrictions add an extra security layer by controlling how certificate authorities can verify domain ownership before issuing certificates.

Comprehensive Incident Reporting

Configure multiple incident reporting channels for comprehensive violation detection:

# Multi-channel incident reporting for CAA violations
yourdomain.com. 3600 IN CAA 0 iodef "mailto:security@yourdomain.com"
# Primary: Security team email notification
# Immediate human alerting for policy violations

yourdomain.com. 3600 IN CAA 0 iodef "https://yourdomain.com/caa-report"
# Secondary: Automated webhook for SIEM integration
# Programmatic processing of violation reports

yourdomain.com. 3600 IN CAA 0 iodef "mailto:ciso@yourdomain.com"
# Tertiary: Executive notification for critical violations
# Escalation path for high-impact security events

# Benefits of multiple reporting channels:
# - Redundancy prevents missed violations due to single point of failure
# - Different channels serve different response workflows
# - Email for immediate human response, webhooks for automated analysis

Multiple incident reporting channels ensure comprehensive visibility into certificate abuse attempts and enable both automated and manual incident response procedures.

Certificate Authority Selection

Choose appropriate certificate authorities for your needs

Popular Certificate Authorities

Choose appropriate certificate authorities based on your security requirements, budget constraints, and operational needs.

Different certificate authorities offer varying levels of validation, pricing models, and integration capabilities. Free CAs provide automated certificate management ideal for most websites, while commercial CAs offer extended validation, insurance coverage, and premium support. Cloud platform CAs provide seamless integration with hosting infrastructure and automated management capabilities.

Free Certificate Authorities

Cost-effective certificate authorities with automated issuance and renewal:

# Free certificate authorities for cost-effective SSL/TLS protection
yourdomain.com. 3600 IN CAA 0 issue "letsencrypt.org"      # Most popular free CA
# - Domain Validation (DV) certificates only
# - 90-day certificate lifetime with automated renewal
# - ACME protocol support for automation
# - Rate limits: 50 certificates per registered domain per week

yourdomain.com. 3600 IN CAA 0 issue "buypass.com"          # European free CA alternative
# - 180-day certificate lifetime (longer than Let's Encrypt)
# - Norwegian-based CA with GDPR compliance
# - Less restrictive rate limits than Let's Encrypt
# - Good backup option for Let's Encrypt

yourdomain.com. 3600 IN CAA 0 issue "ssl.com"              # Free tier available
# - Domain validation certificates at no cost
# - Commercial CA with free offering
# - 90-day certificates with ACME support
# - Upgrade path to commercial certificates

Free CAs are ideal for most websites requiring basic SSL/TLS protection. Let's Encrypt leads the market with widespread automation support and excellent tooling ecosystem.

Commercial Certificate Authorities

Premium certificate authorities offering enhanced validation and support:

# Commercial certificate authorities for enterprise and high-trust applications
yourdomain.com. 3600 IN CAA 0 issue "digicert.com"         # Premium global CA
# - Domain Validation (DV), Organization Validation (OV), Extended Validation (EV)
# - Up to $1.75M warranty coverage for EV certificates
# - Certificate Transparency monitoring and alerting
# - Premium technical support and account management

yourdomain.com. 3600 IN CAA 0 issue "globalsign.com"       # Established enterprise CA
# - Full range of certificate types including code signing
# - Multi-year certificates (up to 3 years for some types)
# - Global presence with local support teams
# - PKI-as-a-Service offerings for enterprise

yourdomain.com. 3600 IN CAA 0 issue "sectigo.com"          # Volume-focused commercial CA
# - Competitive pricing for bulk certificate purchases
# - Automated certificate lifecycle management
# - Integration with major hosting providers
# - Good choice for web hosting companies and resellers

yourdomain.com. 3600 IN CAA 0 issue "entrust.net"          # Government and high-security CA
# - FIPS 140-2 Level 3 compliant HSMs
# - Government and military certificate programs
# - High-assurance EV certificates with strict validation
# - Preferred for regulated industries and government contracts

Commercial CAs provide enhanced validation processes, warranty coverage, and premium support essential for high-value transactions and regulated industries.

Cloud Platform Certificate Authorities

Integrated certificate authorities from major cloud platforms:

# Cloud platform certificate authorities with infrastructure integration
yourdomain.com. 3600 IN CAA 0 issue "amazon.com"           # AWS Certificate Manager (ACM)
# - Free certificates for AWS services (CloudFront, ALB, API Gateway)
# - Automatic renewal and deployment to AWS resources
# - No cost for certificates used within AWS infrastructure
# - Cannot export private keys (AWS-managed only)

yourdomain.com. 3600 IN CAA 0 issue "google.com"           # Google Trust Services
# - Integrated with Google Cloud Platform services
# - Automatic certificate provisioning for GCP resources
# - Used by Google-managed SSL certificates
# - Seamless integration with Google Cloud Load Balancer

yourdomain.com. 3600 IN CAA 0 issue "microsoft.com"        # Microsoft/Azure certificates
# - Azure App Service managed certificates
# - Integration with Azure Front Door and Application Gateway
# - Automatic renewal within Azure ecosystem
# - Free for Azure-hosted applications

Cloud platform CAs provide the best integration with their respective hosting environments, offering automated management and zero-cost certificates for platform services.

Recommendation: Start with Let's Encrypt for basic needs, add a commercial CA for extended validation requirements, and include your cloud platform's CA if using managed services.

Deployment Strategy

Implement CAA records safely:

• Start with monitoring-only using iodef records to detect unauthorized attempts
• Add issue records for your current certificate authority first
• Test certificate renewal processes before adding restrictive policies
• Include backup certificate authorities for redundancy
• Monitor CA validation logs for any issues or unauthorized attempts
• Coordinate with infrastructure teams before implementing restrictions

Subdomain Considerations

CAA inheritance and subdomain policies:

# Parent domain policy (inherited by subdomains)
yourdomain.com CAA 0 issue "letsencrypt.org"

# Subdomain-specific policy (overrides parent)
api.yourdomain.com CAA 0 issue "amazon.com"

# Wildcard-specific authorization
yourdomain.com CAA 0 issuewild "digicert.com"

# Block all issuance for specific subdomain
restricted.yourdomain.com CAA 0 issue ";"

Monitoring and Maintenance

Maintain and monitor CAA record effectiveness

Verification and Testing

Verify CAA record implementation and functionality:

# Check CAA records using dig
dig yourdomain.com CAA

# Verify CAA policy using online tools
# - SSLLabs SSL Test (includes CAA checking)
# - CAA Record Checker tools
# - Certificate Transparency logs

# Test certificate issuance with authorized CA
certbot certonly --manual --preferred-challenges dns -d yourdomain.com

# Verify unauthorized CA blocking (testing only)
# Use different CA tools to confirm rejection

• Regular testing of certificate renewal processes
• Monitoring of Certificate Transparency logs for unauthorized certificates
• Validation of CAA record propagation across DNS servers
• Testing of backup certificate authorities and redundancy

Incident Response

Handle unauthorized certificate attempts:

• Set up automated alerts for iodef notification emails
• Establish procedures for investigating unauthorized issuance attempts
• Contact certificate authorities about policy violations
• Report fraudulent certificates to browser vendors and CT logs
• Document incidents for security awareness and policy improvements
• Review and update CAA policies based on attack patterns

Best Practices

• Regular review and update of authorized certificate authorities
• Coordination with certificate management and renewal processes
• Integration with certificate monitoring and alerting systems
• Staff training on certificate security and CAA record management
• Documentation of certificate issuance policies and procedures
• Periodic audits of certificate usage and CAA record effectiveness

Last updated: January 8, 2026