What is a CAA policy?

What is a CAA policy?

DNS Certification Authority Authorization (CAA) is an Internet security policy mechanism which allows domain name holders to indicate to certificate authorities whether they are authorized to issue digital certificates for a particular domain name. It is an Internet Engineering Task Force (IETF) proposed standard.

What is a sub domain DNS?

A subdomain is a domain that is a part of a larger domain under the Domain Name System (DNS) hierarchy. It is used as an easy way to create a more memorable Web address for specific or unique content with a website. A subdomain is also known as a child domain.

How do I get my CAA record?

You can add a CAA record in the Control Panel.

1. Log in to IONOS.
2. Click on the Domains & SSL tile in the My Products section.
3. For the desired domain, click on thegear symbol under Actions and then on DNS.
4. Click ADD RECORD and select CAA on the Add a DNS Record page.

What does CAA mean for a domain name?

Certification Authority Authorization (CAA) records allow a domain name holder to specify one or more Certification Authorities (CAs) authorized to issue certificates for that domain. ( RFC 6844) CAA records are intended to prevent CAs from improperly issuing certificates. CAA records can set policy for the entire domain, or for specific hostnames.

Why do you need a CAA certificate for DNS?

CAA technology gives the domain name owner freedom to create a DNS CAA record that states which Certification Authorities, if there are any, are permitted to issue certificates for the said domain. CAA is so useful as it can significantly reduce a series of certificate miss-issuances that might result from malicious individuals’ mistakes or deeds.

Can a CAA record apply to a subdomain?

It is also vital to note that, unless overridden, a CAA record for the main domain will cut across all its subdomains. For instance, a CAA record for www.domain.com will apply to its subdomains, like login.domain.com and blog.domain.com.

What’s the structure of a DNS CAA record?

The DNS CAA record is specified by RFC 6844. The structure of a CAA record follows the standard top-level format definition defined in RFC 1035. The RDATA section is composed of the following elements: An unsigned integer between 0-255. It is currently used to represent the critical flag, that has a specific meaning per RFC.