DNSSEC and CAA: the two records nobody sets

Let's be honest up front: if your .env is public or your email is spoofable, close this tab and go fix those first. DNSSEC and CAA are the finishing touches — the stuff that rounds out a clean report rather than the stuff that gets you breached. But they're cheap, they're real, and a scanner will note their absence, so here's what they do.

DNSSEC — sign your DNS

Plain DNS answers aren't authenticated. When a resolver asks “where's yourdomain.com?”, it takes the first valid-looking answer it gets — and an attacker positioned in the path can forge one, quietly pointing your visitors (or your mail) at their own server. DNSSEC cryptographically signsyour DNS records so resolvers can verify an answer genuinely came from you and wasn't tampered with in transit.

The good news is you almost never touch the crypto yourself:

1. 1

   Enable signing at your DNS host.

   At most managed providers (Cloudflare, Route 53, and friends), DNSSEC is a single switch that generates and rotates the keys for you.
2. 2

   Publish the DS record at your registrar.

   Turning it on gives you a DS record — a fingerprint of your signing key. Paste it into your domain's settings at the registrar. That link is what makes the chain of trust verifiable from the root down.
3. 3

   Verify, then leave it alone.

   Confirm it validates, and you're done. One caveat worth flagging: if you ever migrate DNS providers, plan the key rollover carefully — yanking DNSSEC without coordinating the change can make your domain fail to resolve entirely.

CAA — say who may issue your certs

By default, any certificate authority in the world will issue a TLS certificate for your domain to whoever passes their validation. A CAA record is a short public note that says “only these CAs are allowed to issue for me” — so a mis-issued or rogue certificate from anyone else gets refused at issuance time.

The first line whitelists your CA — name every authority you actually use (your host's, your CDN's). The optional iodef line asks CAs to email you if someone attempts an issuance you didn't authorize. After adding it, confirm your normal cert renewals still succeed — if you forgot a CA, its issuance will start failing.

Where these sit on the list

Do them after DMARC, your exposed secrets, and your headers. They're not going to be the thing that gets you ransomed. But they take ten minutes between them, they harden the layer everything else depends on — DNS — and they turn the last two lines of a padded “audit” email into a shrug.