CAA record asal mein kya rokta hai?

Wo aapke naam par certificate jaari karne se un sabhi trusted CAs ko rokta hai jo aapki list mein nahin hain. CA ke liye ye check anivarya hai, isliye ye mis-issuance rokta hai, traffic nahin.

Kya har subdomain par CAA record chahiye?

Nahin. CA naam se upar ki taraf tree chadhti hai jab tak CAA record set nahin milta, isliye apex par ek record neeche sab kuch cover kar leta hai.

Critical flag 128 kya karta hai?

Wo CA ko kehta hai ki tag samajh na aaye to issuance rok de. Future tags ke liye upyogi hai par aaj risky — jab tak wahi na chahiye, 0 hi rakhiye.

Kisi domain par sab issuance kaise band karein?

Ek issue record publish kijiye jiski value ";" ho — sirf semicolon. Yahi standard tareeka hai ye kehne ka ki koi CA jaari na kare, un domains ke liye upyogi jo kabhi HTTPS serve nahin karte.

CAA Record Generator

Wo DNS record banaiye jo batata hai ki aapke domain ke liye kaunsi certificate authorities certificate de sakti hain.

CAA Record Generator records aapke browser mein banata hai. Aapke domain aur contact address kabhi upload nahin hote.

DMARC Record Generator kholiye

CAA Record Generator ke baare mein

CAA record un certificate authorities ki chhoti si whitelist hai jo aapke domain ke liye certificate jaari kar sakti hain. Har publicly trusted CA ko sign karne se pehle ise check karna hota hai, isliye ek DNS record us attacker ko rok deta hai jo koi bhoola hua subdomain ya purana email alias control karta ho. Record ke teen hisse hote hain — flags, tag aur quoted value — aur issuance todne wali do galtiyan hain: domain ki jagah URL likhna aur aisi tag par critical flag lagana jise CA samajhti nahin.

Features

Let’s Encrypt, DigiCert, Sectigo, Google Trust Services ke liye ready values
issue, issuewild aur iodef tags sahi flag handling ke saath
accounturi aur validationmethods jaise CA parameters
URL, galat iodef value aur khaali tag par validation
Zone file lines aur dashboard fields saath-saath
Records aapke browser mein bante hain

CAA Record Generator kaise use karein

Wo domain likhiye jiska record hai
Jin certificate authorities ko ijazat deni hai unhe joḍiye
Blocked attempts ki report chahiye to iodef address daaliye
Zone lines ya dashboard fields apne DNS provider mein copy kijiye

Example

Input

example.com, allow Let's Encrypt, report to security@example.com

Output

example.com.	3600	IN	CAA	0 issue "letsencrypt.org"
example.com.	3600	IN	CAA	0 iodef "mailto:security@example.com"

issuewild tag na ho to wildcard requests issue list par chalti hain.

Common errors aur troubleshooting

Record publish karne ke baad certificate issuance fail hone lagi. — Shayad aapki CA list mein nahin hai ya uska identifier brand naam se alag hai — ZeroSSL ke certificates sectigo.com ke naam se jaari hote hain. CA ki documentation dekhiye.
Wildcard certificates reject ho rahe hain, normal chal rahe hain. — Wildcards ke liye issuewild tag priority leta hai. Agar aap ise publish karte hain to usme har allowed CA honi chahiye; alag rule nahin chahiye to issuewild mat daaliye.
DNS provider ne value reject kar di. — CAA issue values bare domain names hote hain, URL nahin. https:// prefix aur trailing path hata dijiye.

Aksar pooche jaane wale sawaal

CAA record asal mein kya rokta hai?: Wo aapke naam par certificate jaari karne se un sabhi trusted CAs ko rokta hai jo aapki list mein nahin hain. CA ke liye ye check anivarya hai, isliye ye mis-issuance rokta hai, traffic nahin.
Kya har subdomain par CAA record chahiye?: Nahin. CA naam se upar ki taraf tree chadhti hai jab tak CAA record set nahin milta, isliye apex par ek record neeche sab kuch cover kar leta hai.
Critical flag 128 kya karta hai?: Wo CA ko kehta hai ki tag samajh na aaye to issuance rok de. Future tags ke liye upyogi hai par aaj risky — jab tak wahi na chahiye, 0 hi rakhiye.
Kisi domain par sab issuance kaise band karein?: Ek issue record publish kijiye jiski value ";" ho — sirf semicolon. Yahi standard tareeka hai ye kehne ka ki koi CA jaari na kare, un domains ke liye upyogi jo kabhi HTTPS serve nahin karte.

Related tools

SPF Record Generator — Apne domain ka SPF TXT record banaein aur validate karein.
DKIM Record Generator — Apni signing key wala TXT record banayein aur jaanchein.
DMARC Record Generator — Policy aur reports ke saath DMARC TXT record banaye aur jaanche.
Reverse DNS Generator — IP ya prefix se PTR, reverse zone aur RFC 2317 delegation.
SRV Record Generator — Build and decode SRV records for SIP, XMPP, Minecraft, LDAP and Autodiscover.
CIDR / Subnet Calculator — Ek CIDR block ka network, broadcast, host range aur mask calculate karein.