RFC 8659

DNS Certification Authority Authorization (CAA) Resource Record, November 2019

File formats:

icon for HTML icon for text file icon for v3pdf icon for XML
Status:
PROPOSED STANDARD
Obsoletes:
RFC 6844
Authors:
P. Hallam-Baker
R. Stradling
J. Hoffman-Andrews
Stream:
IETF
Source:
lamps (sec)

Cite this RFC: TXT  |  XML

DOI:  10.17487/RFC8659

Discuss this RFC: Send questions or comments to spasm@ietf.org

Other actions: Submit Errata  |  Find IPR Disclosures from the IETF


Abstract

The Certification Authority Authorization (CAA) DNS Resource Record allows a DNS domain name holder to specify one or more Certification Authorities (CAs) authorized to issue certificates for that domain name. CAA Resource Records allow a public CA to implement additional controls to reduce the risk of unintended certificate mis-issue. This document defines the syntax of the CAA record and rules for processing CAA records by CAs.

This document obsoletes RFC 6844.


For the definition of Status, see RFC 2026.

For the definition of Stream, see RFC 4844.


Download PDF Reader