Adding a CAA Record Set¶
Scenarios¶
If you want to specify CAs authorized to issue HTTPS certificates for your domain name, add CAA record sets for the domain name.
CAA record sets are used to prevent HTTPS certificates from being incorrectly issued.
For details about other record set types, see Record Set Types and Configuration Rules.
Constraints¶
CAA record sets can be added only to public zones.
Procedure¶
Log in to the management console.
In the service list, choose Network > Domain Name Service.
The DNS console is displayed.
In the navigation pane, choose Public Zones.
The Public Zones page is displayed.
Click the zone name.
Click Add Record Set.
The Add Record Set dialog box is displayed.
Set required parameters based on Table 1.
Table 1 Parameters for adding a CAA record set¶ Parameter
Description
Example Value
Name
Prefix of the domain name to be resolved
For example, if the zone name is example.com, the domain name prefix can be as follows:
www: The domain name is www.example.com, which is usually used for a website.
Left blank: The domain name is example.com.
In some cases, you may need to set the record set name to the at sign (@). However, the at sign is not supported. Leave the Name blank.
abc: The domain name is abc.example.com, a subdomain of example.com.
mail: The domain name is mail.example.com, which is typically used for an email server.
*: The domain name is *.example.com, which is a wildcard domain name, indicating all subdomains of example.com.
Left blank
Type
Type of the record set
If a message is displayed indicating that the record set you are trying to create exists, the record set conflicts with an existing record set.
CAA - Grant certificate issuing permissions to CAs
TTL (s)
Cache duration of the record set on a local DNS server, in seconds
The value ranges from 1 to 2147483647, and the default is 300.
If your service address changes frequently, set TTL to a smaller value.
The default value is 300, which is, 5 minutes.
Value
CA to be authorized to issue certificates for a domain name or its subdomains
You can enter a maximum of 50 record values, each on a separate line.
The format is [flag] [tag] [value].
Configuration rules:
flag: certificate authority (CA) identifier, which is an unsigned character ranging from 0 to 255. Usually, the value is set to 0.
tag: a string of 1 to 15 characters composed of letters and digits from 0 to 9. The tag can be one of the following:
issue: authorizes CAs to issue all types of certificates.
issuewild: authorizes CAs to issue wildcard certificates.
iodef: requests notifications once CAs receive invalid certificate requests.
value: authorized CA or email address/URL required for notification once the CA receives invalid certificate requests, depending on the value of tag. The value must be enclosed in quotation marks (""). It is a string of 1 to 255 characters, including letters, digits, spaces, and special characters
-#*?&_~=:;.@+^/!%
0 issue "ca.abc.com"
0 issuewild "ca.def.com"
0 iodef "mailto:admin@domain.com"
0 iodef "http:// domain.com/log/"
Tags
(Optional) Identifier of a resource
Each tag contains a key and a value. You can add a maximum of 20 tags to a record set. This parameter is displayed when you enable Other Settings.
For details about tag key and value requirements, see Table 2.
example_key1
example_value1
Description
(Optional) Supplementary information about the record set
You can enter a maximum of 255 characters.
-Table 2 Tag key and value requirements¶ Parameter
Requirements
Example Value
Key
Cannot be left blank.
Must be unique for each resource.
Can contain a maximum of 36 characters.
example_key1
Value
Cannot be left blank.
Can contain a maximum of 43 characters.
example_value1
Switch back to the Record Sets page.
View the added record set in the record set list of the zone and ensure that the status of the record set is Normal.