How do you deploy CAA records to actually constrain who can issue for your domain?

How do you deploy CAA records to actually constrain who can issue for your domain?

CAA (Certification Authority Authorization, RFC 8659) is a DNS record telling CAs which of them may issue certificates for your domain. CAs are required to check it at issuance. Deployment checklist.

— Inventory every CA you legitimately use today, including those behind a CDN or a cloud load balancer that auto-provisions certs. Omitting one breaks its renewals.
— Publish issue tags for each allowed CA and a separate issuewild if you restrict wildcard issuance specifically.
— Add an iodef tag with a mailto or URL so a CA can report a blocked, possibly unauthorized, issuance attempt to you.
— Understand the tree-climbing rule: CAs check the most specific name, then ascend to the parent domain. A record at the apex covers subdomains unless overridden lower.
— Verify with dig CAA example.com +short and confirm DNSSEC where possible, since CAA's value rests on the resolver trusting the answer.

Evidence vs. speculation: CAA constrains issuance, not use; it cannot revoke a cert already issued before the record existed.

Further reading: RFC 8659 and RFC 8657 (account and validation-method binding).

Bottom line: enumerate all current issuers first; a forgotten CA turns CAA into a self-inflicted outage.