Hello,
My organization has a vendor: Stape. To provide their service, which is server-side tracking to capture more tracking data, they require some CAA records on a subdomain on our domain.
For example, they want several CAA records on ssapi.mycompany.com. The CAA records would be:
– sectigo.com
– letsencrypt.org
– zerossl.com
It's my take that we should not be providing this, as our company does not use these providers for our SSL needs and adding these CAA records (even if only on a subdomain) is essentially saying certificates from these CA providers are valid and should be accepted on our domain. It's my feeling that we should push back on this and either identify alternative methods or vendors.
Would anyone be able to share some thoughts around this, in terms of CAA DNS records best practices, particularly in this kind of scenario? Appreciated!!
Source: r/dns · by /u/sevenisthekeynumber