CAA

CAA, short for Certification Authority Authorization, is a DNS record that identifies the certificate authorities a domain authorizes to issue certificates. A compliant CA checks applicable CAA records before issuance. DNSSEC can authenticate the DNS response carrying the policy. CAA reduces unintended issuance through compliant processes. CAA does not make browsers reject certificates from other issuers, revoke existing certificates, or stop someone who forges certificates with a compromised CA signing key. CAA specifies issuer authorization, while domain validation remains a separate requirement.