CAA record validation check

None.

Resource Records.

All nameserver IP addresses.

Every 5 minutes.

None.

High.

Purpose

The CAA records (Certificate Authority Authorisation) control which type of certificates can be issued and from which certification authority.

The CAA was introduced by the IETF in 2010 in response to growing concerns about the security of publicly trusted CA’s. It introduces a security policy mechanism to indicate to CAs whether they are allowed to issue digital certificates for a particular domain name.

The CAA validation check verifies that the CAA records remain unchanged by comparing the result of the check with the CAA records recorded when the check was set up.

Event severities and messages

Records mach.
No detected changes to the CAA record.

DNSSEC signature validates correctly.*
DNSSEC signature for the CAA record set has passed validation.

The record {Resource Record}exist in the domain but not as record type CAA.
No CAA record found.

The record {Resource Record} does not exist..
The query received a NXDOMAIN response.

Unrecognised records.
Lists records that should have been in the query response but weren’t.

Missing records.
Lists records that should have been included in the query response but weren’t.

{DNS IP} responded with RCODE for the record {Resource Record}.
Please see the Generic DNS response code page for further information.

DNSSEC validation failure.*
DNSSEC signature for this resource record has failed validation.

{DNS Name/IP} responded with RCODE for the record {Resource Record}.
Please see the Generic DNS response code page for further information.

* Require DNSSEC.