Syntax: example.com. CAA 0 issue "letsencrypt.org", CAA 0 issuewild ";" (forbid wildcards), CAA 0 iodef "mailto:security@example.com". CAs look up the exact name and then each parent until they find a CAA record set; no records at all means any CA may issue. Flag 128 marks a tag as critical, and a CA that does not understand a critical tag must refuse.
RFC 8657 adds parameters that bind issuance to an ACME account (accounturi=…) and to validation methods (validationmethods=dns-01). The Baseline Requirements recommend processing them now and require it from 15 March 2027. CAA checks are corroborated from multiple network perspectives, and a DNSSEC validation failure must be treated as a refusal.
CAA limits which CAs a compromised or careless validation can use; it does not stop a permitted CA from misissuing, which is what Certificate Transparency monitoring is for. The CAA record generator builds a record set for your CAs.