A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap.emea.contoso.local, with certificates signed by an internal CA. Can a CAA record on contoso.local enforce that only the official Contoso CA can sign a certificate for Contoso domains?


Using CAA DNS records for internal networks doesn't really make sense, especially when you're using a .local domain.

Simply put: The way CAA records work is that an issuing CA will check the CAA records of a domain through public DNS records but only if the issuing CA is told to do so.

Public CAS are required to do that. But a public certificate authority cannot issue to a .local domain anyway since domain control is not verifiable.

Someone who set up an internal CA however could still issue to your contoso.local domain since his CA would not have to be configured to check public CAA records.

Hope that helps!

  • 1
    To add to this, part of RFC 6844 which defines CAA records' purpose expressly rejects applications using CAA records for validation of existing certificates, which is the only thing I can really see using internal CAA records for... Unless they think users will set up rogue but non-malicious internal CAs, which will obey the CAA records. :) Oct 4 '19 at 17:37
  • 1
    @AngeloSchilling In theory large private networks with multiple internal CAs could also use private CAA records for informing specific internal CAs to not issue certificates for specific internal hosts.
    – studio2012
    Oct 5 '19 at 8:56
  • @EnosD'Andrea that's true, but lord help the people in charge of managing a network with multiple CAs under disparate teams, who don't know not to issue for each others' domains :P Oct 7 '19 at 20:58
  • 1
    @AngeloSchilling you can also think of CAA as a form of documentation. Some enterprise networks are so large and complex that administrative (and lord) controls are not enough. IT teams may be mistaken, malicious, lazy or more often may bypass rules in good faith. Technical controls are then required to enforce and monitor the important stuff (been there, got the t-shirt).
    – studio2012
    Oct 9 '19 at 5:57
  • @EnosD'Andrea, do you have experience with CA software for internal networks that honor the CAA record? Could you add an answer with an opposing view?
    – Sjoerd
    Oct 9 '19 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.