Hi all,
Has anyone set up CAA records for their webmail page? I am assuming SSL certs are issued by LetsEncrypt but was hoping for a concrete answer. I could not find anything about CAA records in the documentation. After recently moving to MXroute and receiving some DMARC reports, several people have already tried to spoof email from my domain. I want to harden and add security where ever I can. I already have the typical DKIM, SPF, & DCIM. From what I have read, the records would look like this:
domain.com CAA 0 issue "letsencrypt.org" (Names LetsEncrypt as the sole SSL provider for the domain) domain.com CAA 0 issuewild ";" (Disallows wildcard cert issuance) domain.com CAA 0 iodef "mailto:someemail@somedomain.com" (Notifies the email if someone tries and fails to issue a cert against policy) If anyone could offer any guidance, it would be much appreciated. I am also open to any additional security recommendations. I know spoofing is not entirely preventable, at least in the sense that people will always try, regardless of policy. Thanks!
Source: r/mxroute · by /u/zlega