Certification Authority Authorization (CAA) is a DNS record that names which certificate authorities are allowed to issue certificates for your domain. CAs are required to check it before issuing, so it acts as a guardrail against accidental or malicious mis-issuance.
Why it matters
Without a CAA record, any public CA can issue a certificate for your domain. If an attacker tricks a CA into issuing one, they could impersonate your site. A CAA record limits issuance to the authorities you actually use.
Example
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issuewild ";" (disallow wildcard issuance)
example.com. CAA 0 iodef "mailto:[email protected]" (where to report violations)
Deploying
Add the records at your DNS provider listing every CA you use (including your CDN's). It takes minutes and meaningfully tightens your PKI posture. The SSL/TLS deep grade reads your CAA records as part of the report.