An Empirical Survey on the Early Adoption of DNS Certification Authority Authorization

Understand

A new certification authority authorization (CAA) resource record for the domain name system (DNS) was standardized in 2013.

• Motivated by the later 2017 decision to enforce mandatory CAA checking for most certificate authorities, this paper surveys the early adoption of CAA by using an empirical sample collected from the Alexa's top-million domains.
• According to the results, (i) the adoption of CAA is still at a modest level; only a little below two percent of the popular domains sampled have adopted CAA.
• Among the domains that have adopted CAA, (ii) authorizations dealing with wildcard certificates are rare compared to conventional certificates.