CAA record
also: Certification Authority Authorization record
A CAA (Certification Authority Authorization) record is a DNS record type that specifies which certificate authorities are permitted to issue SSL/TLS certificates for a domain.
CAA records are DNS TXT-like entries that allow domain owners to whitelist specific certificate authorities (CAs) that can issue certificates for their domain. This adds a layer of security by preventing unauthorized CAs from issuing certificates, even if a domain's DNS or registrar is compromised.
A CAA record consists of flags, a tag (typically issue, issuewild, or iodef), and a value identifying the CA. For example: 0 issue "letsencrypt.org" allows Let's Encrypt to issue standard certificates for your domain.
Most modern certificate authorities check CAA records before issuing certificates. If no CAA record exists, any CA can issue; if one exists and your CA isn't listed, the certificate request will be denied.