DNS CAA Records: How to Restrict Which CAs Can Issue Your SSL Certificate (2026)

Imagine someone walked into a locksmith with a copy of your address and asked for a key to your house. Now imagine that was possible with SSL certificates too — any Certificate Authority could, in theory, issue a certificate for your domain without your knowledge. For years, this was an accepted risk of the CA system.