4

I get following DNS CAA record for google.com using Google public DNS server

google.com. CAA 0 issue "symantec.com"

For www.google.com and mail.google.com I do not see DNS CAA record. Does above CAA record applies for all sub domains of google.com?

Can any other CA (apart from "symantec.com") that supports CAA would issue certificate for mail.google.com ?

3

Does above CAA record applies for all sub domains of google.com?

All subdomains that do not specify CAA records of their own.

See, for example, the example in section 3:

The following example is a DNS zone file (see [RFC1035]) that informs
CAs that certificates are not to be issued except by the holder of
the domain name 'ca.example.net' or an authorized agent thereof.
This policy applies to all subordinate domains under example.com.

$ORIGIN example.com
.       CAA 0 issue "ca.example.net"

And the lookup algorithm in section 4.

If, for example, mail.google.com had its own CAA record (it currently doesn't), that record would apply to requests for certificates for mail.google.com.

Can any other CA (apart from "symantec.com") that supports CAA would issue certificate for mail.google.com ?

If their DNS queries are successful and they strictly follow the CAA policy, no. As it currently stands, few CAs implement CAA, and some consider CAA more what you'd call guidelines than actual rules, and flag certificates for extra scrutiny, but don't out and out reject issuance.

Regarding your specific example of mail.google.com, any halfway competent CA has google.com on its VIP list and flags requests for certificates, rejecting them outright or making doubly damn sure they're valid. It's very unlikely a random CA would misissue -- or issue at all -- a google.com certificate unless their validation systems were compromised or people had guns to their heads.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.