Concept
Most people can name A, MX, and TXT without thinking. This lesson covers where real rigor lives: the CNAME coexistence rule (a name with a CNAME record MUST NOT have any other record type at that same name — RFC 1035 forbids it, and violating it produces undefined/inconsistent resolver behavior, not a clean error); SRV records (structured service-discovery entries used by protocols like SIP/XMPP, encoding priority, weight, port, and target host in one record); and CAA (Certification Authority Authorization) — a record type that lets a domain owner restrict which Certificate Authorities are permitted to issue TLS certificates for that domain at all, checked by CAs at issuance time.
Common Misconception
"CAA is optional hardening, not something that actually stops anything." In practice, every publicly-trusted CA is required (per the CA/Browser Forum Baseline Requirements) to check CAA before issuing a certificate — an absent CAA record means ANY CA can issue a cert for your domain if they're tricked into it (via domain validation weaknesses, internal CA error, etc.), while a correctly scoped CAA record makes an entire class of mis-issuance impossible by policy, not just discouraged.
Hands-On Exercise
No lab environment needed:
- marinadns.io/dig — query A, AAAA, MX, TXT, SRV, and CAA records directly for any domain, including your own.
- marinadns.io/ssl — inspect a domain's actual issued certificate and confirm it was issued by a CA your CAA record actually authorizes.
For the CNAME-coexistence violation test and adding/verifying a CAA record with an iodef reporting tag, see Lesson 4 in the DNS Admin Course Lab Environment page.
Commands to Run
# Basic address records
dig yourdomain.com A
dig yourdomain.com AAAA
# CNAME coexistence rule check — a CNAME must be the ONLY record at that name
dig www.yourdomain.com CNAME
dig www.yourdomain.com ANY # should show nothing else at this name
# MX
dig yourdomain.com MX +short
# SRV (example: a service advertising itself via DNS)
dig _sip._tcp.yourdomain.com SRV
# CAA — who is authorized to issue certs for this domain
dig yourdomain.com CAA +short
Add a CAA record restricting issuance to one CA (e.g. 0 issue "letsencrypt.org"), then confirm via dig it's visible before relying on it — and note that CAA is checked by the CA at issuance time, not by browsers at connection time.
Mastery Checkpoint
You should be able to explain, without looking anything up:
- Why a CNAME record can never coexist with any other record type at the same name, and what breaks if it does.
- What CAA actually prevents, and at what point in the certificate-issuance process it's checked.
- What an SRV record's four fields (priority, weight, port, target) each control.
If you can answer all three without re-reading this lesson, move to Lesson 5.
← DNS Admin Course Lab Environment
