CAA Record Lookup shows which certificate authorities a domain permits to issue TLS certificates for it. Without a CAA record, any publicly trusted CA in the world may issue a certificate for your name, and there are well over a hundred of them. Publishing a CAA record narrows that to the ones you actually use, so a mistaken or malicious request elsewhere is refused at issuance time. Since 2017 CAs are required to check CAA before issuing, which makes it one of the few DNS records that other parties are obliged to honour. A record has a flag, a tag and a value: the issue tag names a CA allowed to issue normal certificates, issuewild controls wildcard certificates separately, and iodef gives an address where violation reports are sent. CAA is also inherited upward: if a subdomain has no record of its own, the resolver walks up the tree until it finds one, so a record at the apex covers everything beneath it. The most common failure is forgetting to add a CA before switching providers, which makes issuance fail with a CAA error rather than anything obviously DNS related.
DNS resolution happens in multiple stages. When you type a domain name, your browser first checks its own cache, then the OS resolver cache, then queries your configured DNS resolver (usually your ISP or a public resolver like 8.8.8.8 or 1.1.1.1). If none have the record cached, the resolver performs a recursive query: it asks the root name servers for the TLD servers (.com, .net, etc.), then asks the TLD servers for the authoritative name servers of the specific domain, and finally asks the authoritative servers for the actual record. This entire process typically completes in under 100ms. DNS-over-HTTPS (DoH) encrypts DNS queries in HTTPS traffic, preventing ISPs and network observers from seeing which domains you query. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers. Google and Cloudflare both operate free public DoH endpoints (dns.google and cloudflare-dns.com). TXT records have become a critical security mechanism: SPF (Sender Policy Framework) records specify which servers are allowed to send email for a domain, DKIM (DomainKeys Identified Mail) records provide public keys for verifying email signatures, and DMARC records tell receiving mail servers what to do when SPF or DKIM checks fail. Checking these records is the first step in diagnosing email deliverability problems.