Certificate Authority Authorization (CAA) records tell the world which CAs are allowed to issue certificates for your domain. Certificate Transparency logs show which certificates were actually issued.
CAA is preventive — when CAs honour it, mis-issuance from unauthorised CAs should not occur. CT is detective — you can see issuance even when policy was missing, wrong, or bypassed.
A mature programme uses:
Good Roots Work provides a free CAA policy tool for analysis and Domain Connect deployment. The same CAA understanding feeds our monitoring platform when you subscribe.
