A DNS record limiting which authorities may issue for your domain.
WHAT IT DOES
A CAA record names the certificate authorities permitted to issue certificates for your domain. Authorities are required to check it and refuse if they are not listed.
WHY IT HELPS
It reduces the risk of a certificate being issued for your domain by an authority you do not use, whether through error or attack.
SETTING ONE
Add a CAA record in your DNS. The value names the permitted authority.
If you use AutoSSL, the record must permit whichever authority issues those certificates. Getting this wrong stops your own renewals.
THE RISK OF SETTING IT CARELESSLY
A CAA record that omits the authority AutoSSL uses causes renewal to fail silently until the certificate expires.
BEFORE ADDING ONE
Check which authority currently issues your certificates, by viewing the certificate in your browser. Include that authority.
If you are unsure, open a ticket and ask before adding the record.
WHO NEEDS THIS
Organisations with a specific policy on certificate issuance. Most sites do not need it.
