CAA records in 2026: who guards a domain against a stray certificate

A CAA record in DNS lists the certificate authorities allowed to issue certificates for a domain. An authority is obliged to check it before issuing: if it is not listed, it must refuse.

The point is to stop an unrelated authority issuing a certificate for your domain — by mistake, on a forged request, or after an administrator’s mailbox is compromised. Without CAA nothing blocks such a request except the authority’s own internal procedures.

The record is free and set once. It nevertheless remains rare, and the numbers below show how rare.

On 27 August 2026 we queried CAA records for domains users had brought to our tools, 150 per zone. The query was dig CAA against a public resolver, on the registrable name:

In .ru the record appeared on two domains out of a hundred and twenty-five — six times rarer than in .com and eleven times rarer than in .org.

Sampling caveat: these are domains somebody chose to check, not a random slice of the zone. Comparing zones is sound — they were collected identically — but the .ru level cannot stand in for "the Russian web". One lookup per zone failed and is excluded from the counts.

Separately we measured DNSSEC signing — a different protection, but one that also lives in DNS and also depends on the registrar. The result points the same way:

Two independent measurements, different records, different mechanisms — and the same gap. That is no longer a coincidence but a property: Russian domains are weak specifically at the DNS layer, not at the server. On TLS, as a reminder, .ru runs level with .com.

The explanation consistent with both: DS and CAA are both set through the registrar’s control panel. Where no field exists for them, the owner simply cannot finish the job however much they know about it. TLS configuration does not depend on the registrar, and there the gap is absent.

Among domains that do carry the record, the most frequently authorised are: in .org — Let’s Encrypt (33 mentions), Google Trust Services (20), DigiCert (19); in .com — Let’s Encrypt (14), DigiCert (12), Google Trust Services (10); in .net — Let’s Encrypt (22), Google Trust Services (13).

We give no breakdown for .ru: only two domains carry the record, and any share computed on that base would be meaningless.

A domain usually authorises several authorities at once, which is why mentions outnumber domains.

1. Check whether you have one. It shows up in the DNS lookup alongside the domain’s other records.
2. Set it if your registrar’s panel allows. The minimal form is one line authorising the authority you use. List every authority you might need, including a fallback: a domain that authorised only one will not get a certificate from another in a hurry.
3. Remember subdomains. The check walks up the tree, so a record at the second level applies below it — but a subdomain needing a different authority needs its own record.
4. Look at DNSSEC while you are there. Both records are set in the same place for the same reason; a panel that offers one usually offers the other.