A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap.emea.contoso.local, with certificates signed by an internal CA. Can a CAA record on contoso.local enforce that only the official Contoso CA can sign a certificate for Contoso domains?

1 Answer 1


Using CAA DNS records for internal networks doesn't really make sense, especially when you're using a .local domain.

Simply put: The way CAA records work is that an issuing CA will check the CAA records of a domain through public DNS records but only if the issuing CA is told to do so.

Public CAS are required to do that. But a public certificate authority cannot issue to a .local domain anyway since domain control is not verifiable.

Someone who set up an internal CA however could still issue to your contoso.local domain since his CA would not have to be configured to check public CAA records.

Hope that helps!

  • 1
    To add to this, part of RFC 6844 which defines CAA records' purpose expressly rejects applications using CAA records for validation of existing certificates, which is the only thing I can really see using internal CAA records for... Unless they think users will set up rogue but non-malicious internal CAs, which will obey the CAA records. :) Oct 4, 2019 at 17:37
  • 1
    @AngeloSchilling In theory large private networks with multiple internal CAs could also use private CAA records for informing specific internal CAs to not issue certificates for specific internal hosts. Oct 5, 2019 at 8:56
  • @EnosD'Andrea that's true, but lord help the people in charge of managing a network with multiple CAs under disparate teams, who don't know not to issue for each others' domains :P Oct 7, 2019 at 20:58
  • 1
    @AngeloSchilling you can also think of CAA as a form of documentation. Some enterprise networks are so large and complex that administrative (and lord) controls are not enough. IT teams may be mistaken, malicious, lazy or more often may bypass rules in good faith. Technical controls are then required to enforce and monitor the important stuff (been there, got the t-shirt). Oct 9, 2019 at 5:57
  • @EnosD'Andrea, do you have experience with CA software for internal networks that honor the CAA record? Could you add an answer with an opposing view?
    – Sjoerd
    Oct 9, 2019 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .