CAA record suport on which server

338 views Asked by At

From 8th september 2017 its mandatory to have CAA record for SSL certificate from CA/Browsers forum on DNS Server.

On my Linux's server I upgrade Bind to 9.8 and its now support CAA record and as I know its work from Bind 9.6 My Question is about Microsoft DNS server. i have a win 2003 and DNS server v 5.2.3 and tried to add this record manually to C:\WINDOWS\system32\dns\domainzone.dns with no sucess as I know microsoft is a part os CA/B forum but I did not found any news from microsoft to point about DNS server version for this Record. Should I move to win 2012/2016 or could I just upgrade DNS server?

1

There are 1 answers

2
Steffen Ullrich On

From 8th september 2017 its mandatory to have CAA record for SSL certificate from CA/Browsers forum on DNS Server.

You are not required to have a CAA record as domain owner. It is only a requirement for the CA's to check if there is a CAA record for the domain and if they are allowed to issue a certificate based on this record.

This means, if there is no CAA record for the domain every public CA is allowed to issue a certificate for it. And this does not mean that you cannot get a certificate if you don't have a CAA record.