RFC 8659 / START HERE
DNS CAA issuance policy, before the details
CAA means Certification Authority Authorization. A certification authority (CA) issues certificates: signed digital documents websites use to help establish their identity.
RFC 8659 lets a domain holder publish records in the Domain Name System (DNS) naming the CAs permitted to issue certificates for that domain. A CA checks this policy before issuance. A browser must not use CAA records to decide whether an already-issued certificate is valid.
Why it exists
The policy reduces unintended issuance, but passing CAA is only one condition for issuing a certificate. This publication replaces RFC 6844 and simplifies how a CA finds the relevant policy when DNS aliases are involved. It also explains ordinary names, wildcards and properties a CA must understand.
A familiar example
For example, example.com can authorize ca1.example.net, reserve wildcard certificates for ca2.example.org, and publish a reporting contact. The chapters follow the DNS search, decode the record and test what each issuer may do. The names and contacts are fictional and inert; no certificate or report is created.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Check policy before issuingCAA tells a certification authority which issuers the domain holder authorizes. It is an issuance check, not a browser trust decision.→
- Find the first relevant record setSearch the requested name and then its parents, stopping at the first nonempty CAA answer.→
- Follow aliases without climbing their treeA CAA query follows an alias, but an empty result resumes the parent search on the original name.→
- Read property bytes and critical flagsOne flags octet and one tag-length octet precede a property tag and the remaining value bytes.→
- Combine issuers and handle wildcardsAuthorizations within one relevant set are additive. A wildcard-specific policy can replace the ordinary issue policy for wildcard names.→
- Separate reporting, absence and lookup errorsA reporting contact does not authorize an issuer. A valid empty DNS answer is different from a failed lookup.→
This introduction explains RFC 8659 (2019). Read the original RFC ↗