3 ms·

But CAA is fully dependent on DNS(Sec).

• koolba 10y ago
  Why would that be the case? Can't I have untrusted records indicating you can't do something (issue a cert for a domain)? That's how SPF / DKIM works. At worst you'd get false rejections which you'd follow up on immediately as your cert wouldn't be issued.