看到 Amazon Route 53 要支援 DNS CAA 的消息：「Announcement: Announcement: CAA Record Support Coming Soon」。
裡面有提到 CA/Browser Forum 的決議，要求各瀏覽器支援 DNS CAA：
On March 8, 2017, the Certification Authority and Browser Forum (CA/Browser Forum) mandated that by September 8, 2017, CA’s are expected to check for the presence of a CAA DNS record and, if present, refuse issuance of certificates unless they find themselves on the whitelist <https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/>.
DNS CAA 可以設定哪些 SSL certificate 可以發出你的證書，除了自己以外，也可以讓第三者比較容易確認是否有誤發的行為：
We have seen a lot of interest in Amazon Route 53 support for Certification Authority Authorization (CAA) records, which let you control which certificate authorities (CA) can issue certificates for your domain name.