Appart from DNS many CAs do web or email based checks. And those had quite a few vulnerabilities in the past, e.g. in the extraction of whois records (via OCR..

Appart from DNS many CAs do web or email based checks. And those had quite a few vulnerabilities in the past, e.g. in the extraction of whois records (via OCR...) [1] or through markup injection in the validation emails [2]. CAA can prevent misissuance in such cases. Having an extra safety layer around these is definitely useful. It's not a super strong measurement like HPKP and CT, but still I think CAA is a useful extra security mechanism in the CA ecosystem. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 [2] https://thehackerblog.com/keeping-positive-obtaining-arbitrary-wildcard-ssl-certificates-from-comodo-via-dangling-markup-injection/ https://thehackerblog.com/keeping-positive-obtaining-arbitra...