CAA and DANE in brief
Both use DNS to protect certificates, but from different directions. CAA tells certificate authorities who may issue. DANE tells mail servers which certificate to trust.
CAA: who may issue certificates?
Since 2017 every public CA must check the domain’s CAA record before issuing. If it only lists letsencrypt.org, all other CAs reject requests. Without a record any CA may issue. The lookup climbs up from the requested name, so a record at example.com also applies to www.example.com unless the subdomain has its own.
issue: CAs for normal certificates.issuewildonly applies to wildcards and replacesissuefor them.iodef: address where CAs can report rejected requests.accounturiandvalidationmethods: with Let's Encrypt, issuance can be limited to one account or to the DNS challenge.
If you use services that obtain certificates for your domain themselves (Cloudflare, Microsoft 365, Shopify, hosting providers), their CAs must be in CAA, otherwise renewal fails there. The certificate search shows which CAs have issued so far.
DANE: pinning certificates with DNSSEC
Mail servers encrypt between each other with STARTTLS but usually do not check the certificate. An attacker can therefore switch encryption off unnoticed. DANE fixes this: a TLSA record at _25._tcp.mx.example.com states which certificate or key is valid, and DNSSEC protects that record from forgery. Many large providers check DANE, especially in Germany and the Netherlands.
Changing certificates without an outage
- Obtain the new certificate but do not install it yet.
- Publish the TLSA record for the new certificate in addition to the old one (generator, “certificate with chain” field).
- Wait at least two TTLs, usually a few hours are enough.
- Install the new certificate on the mail server and check it here.
- Remove the old TLSA record.
It gets easier with 3 1 1 and an unchanged key (e.g. certbot --reuse-key): the record then stays the same on renewal.
FAQ
Do I need a CAA record?
It is not required, but useful and free. It prevents a CA you do not work with from issuing a certificate for your domain, for example after a social-engineering attack.
My provider cannot set CAA records. What now?
Most DNS providers support CAA by now. If not, the domain stays without CAA. That is the normal state and only means any CA may issue.
Why does the check show DNSSEC as inactive?
The zone is not signed or the chain of trust to the root is broken (DS record missing at the registrar). That is no problem for CAA, but DANE does not work without DNSSEC.
Which TLSA records should I use?
For mail servers the combination 3 1 1 (key of the server certificate) and 2 1 1 (key of the issuing CA) is recommended. The generator computes both from the certificate.
Is my data stored?
No. DNS lookups run via the hollop.net server using DNS over HTTPS (Google, falling back to Cloudflare); the certificate is retrieved as in the SSL check. Nothing is stored.