CAA record management
Let op
In DigiCert® DNS, managed domains (as seen in the UI) are referred to as primary domains in the documentation. Both terms refer to the same concept.
Overview
This guide provides detailed instructions for CAA record management, covering both targeted and comprehensive actions.
Targeted actions include:
Comprehensive actions include listing every CAA record provider.
Benefits
CAA record management safeguards against unauthorized certificate issuance, protecting domains from phishing and man-in-the-middle attacks. DigiCert® DNS provides visibility and audit capabilities for rapid detection of misconfigurations, ensuring compliance with industry standards. Centralized management simplifies SSL/TLS certificate administration, reduces overhead, and promotes consistent, secure certificate practices across the organization.
Procedures
Let op
This procedure creates a CAA record (caarecord) for the primary domain domain1. The primary domain was previously created here.
To test this function, call this API endpoint: POST /domains/primary/{domainId}/records/CAA
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
Select the RECORDS tab.
Select the Add Record button.
In the Add Record dialog:
Select CAA from the Record Type drop-down list.
Enter a name in the Name field (for example, caarecord).
Set the TTL value, or keep the default of 600.
Select a Provider value.
Select a Tag value.
Options include issue, issuewild, iodef, issuemail, and issuevmc.
Select an Issuer Critical value.
Options include 0 (not critical) and 1 (critical).
Toggle Enabled to turn the value on or off.
(Optional) To add more entries, select Add Another Value.
(Optional) Select Save and Add Another to add more records.
Select Save and Close to finish.
A message appears confirming the successful creation of the record.
Let op
This procedure deletes a specific CAA record (caarecord) from the primary domain domain1. The primary domain and CAA record were created in earlier procedures. You can follow either Path 1 or Path 2 to complete the deletion.
To test this function, call this API endpoint: DELETE /domains/primary/{domainId}/records/CAA/{recordId}
Path 1
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
In the RECORDS tab, locate the record you want to delete (for example, caarecord).
From the overflow menu (three vertical dots) at the end of the record's row, select Delete.
In the Confirm Deletion dialog, select Confirm.
A message appears confirming the successful deletion of the record.
Path 2
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
In the RECORDS tab, select the checkbox of the record you want to delete.
Tip
You can select multiple checkboxes to delete several records at once.
Go to Actions > Delete Records.
In the Confirm Deletion dialog, select Confirm.
A message appears confirming the successful deletion of the record.
Let op
The current version of DigiCert® DNS does not include a dedicated front-end tab for viewing all CAA record providers. To access this information, use the following endpoint:
GET /records/caa/providers
For help configuring your testing environment, refer to the API guide.
Let op
This procedure displays the details of a specific CAA record (caarecord) created in an earlier procedure. Follow Path 1 if there are only a few results to review. Follow Path 2 if you prefer to filter results quickly.
To test this function, call this API endpoint: GET /domains/primary/{domainId}/records/CAA/{recordId}
Path 1
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
Select the RECORDS tab.
The table displays all the records associated with the domain.
Locate the record (for example, caarecord) whose details you want to view.
Select Columns at the top of the results table, then select all checkboxes to ensure that all record information is displayed.
Path 2
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
Select the RECORDS tab.
The table displays all the records associated with the domain.
Select Filters at the top of the results table to locate the specific record quickly.
Tip
In this example, the name of the record is known, so the following filter was applied:
Under Column, select Name.
Under Operator, select contains.
Under Value, enter the record's name (caarecord).
If no results appear, double-check the Filters selections and input values.
Select Columns at the top of the results table, then select all checkboxes to ensure that all record information is displayed.
Let op
This procedure displays the CAA records of a specific primary domain (domain1). The primary domain was previously created here. You can follow either Path 1 or Path 2 to complete the retrieval.
To test this function, call this API endpoint: GET /domains/primary/{domainId}/records/CAA
Path 1
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
Select the RECORDS tab.
The table displays all the records associated with the domain.
Select Filters at the top of the results table:
Under Column, select Record Type.
Under Operator, select contains.
Under Value, enter CAA.
Select Columns at the top of the results table, then select all checkboxes to ensure that all record information is displayed.
Path 2
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
Select the RECORDS tab.
The table displays all the records associated with the domain.
Toggle Group Records to group records by type.
Select the CAA record drop-down list.
Let op
This procedure updates a specific CAA record (caarecord) created in an earlier procedure.
To test this function, call this API endpoint: PUT /domains/primary/{domainId}/records/CAA/{recordId}
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Domains.
In the MANAGED DNS tab, select the relevant domain (for example, domain1).
Select the RECORDS tab.
The table displays all the records associated with the domain.
Locate the specific record - see Path 2 for quick filtering.
Select the name of the record (for example, caarecord) whose details you want to update.
Alternatively, select the overflow menu (three vertical dots) at the end of the record's row, and select Edit.
In the Edit Record dialog:
Edit the record's details as required.
Select Save to finish.
A message appears confirming the successful update of the record.