DNS and domains
CAA record
A DNS record that says which certificate authorities may issue certificates for a domain. A CA must check it before issuing.
CAA records let a domain owner restrict who may issue TLS certificates for it. Before issuing, a certificate authority looks for CAA records on the name and then on each parent, and uses the first set it finds. If the CA is not listed, it must refuse.
The record has a flag, a tag and a value. issue names a CA allowed to issue ordinary certificates (0 issue "letsencrypt.org"), issuewild the ones allowed to issue wildcards, and iodef an address or URL where refused requests get reported. A value of ; means no CA at all.
Without a CAA record any publicly trusted CA may issue for the name. That is the default and works fine; a record limits the damage if someone manages to trick a CA, and iodef tells you when it happens. Records are only checked at issuance; changing them does not affect certificates that already exist.