CAA Records — Which Authorities May Issue for Your Domain
CAA records name which certificate authorities are permitted to issue certificates for a domain. Authorities are required to check them before issuing, which makes CAA a rare DNS control that meaningfully constrains third parties. This check reports the records present and how they apply across the name hierarchy.
Why run it
In both directions. Without CAA, any public authority may issue for your domain, so a single validation weakness anywhere in that ecosystem is your problem; publishing records narrows that considerably. But a misconfigured record blocks your own renewals, and the failure surfaces at the worst possible time — during an automated renewal that then fails silently until the certificate expires. Records inherit down the tree, so a restriction set at the apex applies to subdomains that may use a different authority entirely.
Why automate it
The dangerous interaction is with certificate automation, which runs unattended and fails quietly. Changing certificate provider without updating CAA produces renewals that fail for weeks while the existing certificate remains valid — the outage is scheduled for the expiry date and nothing indicates it beforehand. Monitoring the records alongside certificate expiry catches that combination, and also alerts on the security-relevant case of a record being removed or widened by someone clearing out DNS.
What it gives you
A genuine constraint on who can issue certificates for your name, plus protection against that constraint becoming the reason renewal fails. The two failure modes point in opposite directions, which is why it deserves monitoring rather than a one-time setup.