DNSSEC and CAA: two records that cost nothing
What DNSSEC protects against and why a broken deployment is worse than none, how a CAA record limits who can issue certificates for your domain, and how to turn both on.
DNS answers are not signed by default. A resolver asking “what is the address of www.yourdomain.com” takes the first plausible answer it gets, and on a hostile network, or through a poisoned cache, that answer can come from someone else. DNSSEC fixes this by signing every record in your zone with a key whose fingerprint is published by the parent zone, all the way up to the root. A resolver that validates DNSSEC rejects forged answers.
CAA records solve a different problem. Any of the roughly 150 public certificate authorities can issue a certificate for your domain if someone proves control of it to that authority. A CAA record names the authorities you actually use; the others are required to refuse. It is a two-line change that turns “any CA, if tricked” into “only ours”.
Both appear in a Perimetry report as findings when absent. Neither costs money.
DNSSEC
What it does and does not do
DNSSEC guarantees that the answer a validating resolver receives is the answer you published. It stops cache poisoning and on-path forgery of DNS, which are the usual first step of several attacks: redirecting mail to a server the attacker controls, obtaining a certificate by passing a DNS-based validation challenge, or serving a fake site to a whole network. It does not encrypt DNS queries (that is DNS over HTTPS or TLS, a separate feature), and it does not protect against a compromised registrar account.
Why “broken” is worse than “missing”
A zone with DNSSEC enabled publishes signatures and a DS record at the parent. If the signatures expire, the keys are rotated without updating the DS, or the zone moves to a provider that does not sign while the DS record stays at the registrar, validating resolvers (Google, Cloudflare, Quad9 and most ISPs today) treat every answer as forged and return an error. The domain disappears for everyone using those resolvers: no website, no mail. This outage is the most common DNSSEC incident and almost always follows a DNS provider change.
Perimetry reports two different findings: DNSSEC not enabled (medium) and DNSSEC broken (high). The second one is checked by asking a validating resolver with the DNSSEC-OK flag and reading whether the response is authenticated or failed validation.
How to enable it
Most managed DNS providers (Cloudflare, Route 53, Google Cloud DNS, Gandi, OVH, Infomaniak) sign the zone with one click and show you the DS record to publish. Then:
- Enable DNSSEC at the DNS provider. Wait until the signed zone is live (the provider says so).
- Copy the DS record (or the DNSKEY, depending on what the registrar asks for) to the registrar’s control panel. If registrar and DNS provider are the same company, this is usually automatic.
- Verify with a validation tool such as DNSViz, or simply wait for the next Perimetry audit, which reports whether the chain validates.
Before you change DNS providers later, remove the DS record at the registrar first, wait for the parent’s TTL to pass (usually a day), then move. Re-enable afterwards. Perimetry’s change section will show the DNSSEC state flipping, which is your confirmation that the migration went as planned.
CAA
What a CAA record says
yourdomain.com. CAA 0 issue "letsencrypt.org"
yourdomain.com. CAA 0 issuewild ";"
yourdomain.com. CAA 0 iodef "mailto:security@yourdomain.com"Read: only Let’s Encrypt may issue certificates for this domain and its subdomains; nobody may issue wildcard certificates; and if an authority receives a request it has to refuse, it may tell this address. Certificate authorities have been required to check CAA since 2017, and the check is done at issuance time, so the record protects you from today.
If you use several authorities (Let’s Encrypt for the main site, DigiCert for a product, Amazon for a load balancer), list each with its own issue line. The identifier for each authority is documented by the authority; common ones are letsencrypt.org, digicert.com, sectigo.com, globalsign.com, amazon.com, google.com, pki.goog, ssl.com, comodoca.com.
What it protects against
An attacker who takes over a subdomain, or who can answer a DNS validation challenge for a few minutes, can obtain a certificate from any authority that accepts the challenge. With a CAA record naming only your authority, every other authority refuses. Combined with DNSSEC, the CAA record itself cannot be forged during the authority’s lookup.
Watching issuance anyway
CAA limits who may issue; it does not tell you when something was issued. Perimetry reads Certificate Transparency logs on every audit and lists recent certificates for your domain with their issuer. When an issuer is not covered by your CAA record, the report says so (certificate issued by an authority your CAA record does not allow), which is either a mistake in your record or a certificate you should ask questions about. The companion guide on Certificate Transparency monitoring explains how to read that section.
What the report looks like
DNSSEC not enabled — medium No DS record is published for
yourdomain.comat the.comzone. Validating resolvers cannot detect forged answers for this domain. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
No CAA record — low Any certificate authority may issue certificates for
yourdomain.com. Publish a CAA record naming the authorities you use, for example0 issue "letsencrypt.org".
The two records together take fifteen minutes. Few other quarter-hours remove as much exposure.
To see where a domain stands, the free DNSSEC checker says whether the zone is signed and validates, and the CAA record checker lists the authorities allowed to issue for a name.