CAA
E697169
CAA (Certification Authority Authorization) is a DNS record type used to specify which certificate authorities are permitted to issue SSL/TLS certificates for a domain.
All labels observed (1)
| Label | Occurrences |
|---|---|
| CAA canonical | 1 |
How this entity was disambiguated
This entity first appeared as the object of triple T7932839 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: CAA Context triple: [Cloud DNS, supportsRecordType, CAA]
-
A.
CAA
CAA is the commonly used abbreviation for the U.S. Clean Air Act, a landmark federal law regulating air emissions to protect public health and the environment.
-
B.
CAA
CAA is a leading professional organization in the United States dedicated to advancing the history, practice, and teaching of the visual arts and design.
-
C.
CAA
CAA is a collegiate athletic conference in the United States that sponsors competition in numerous NCAA Division I sports.
-
D.
CAA
CAA is Japan’s national Consumer Affairs Agency responsible for protecting and promoting consumer rights and safety.
-
E.
CAA
CAA is the abbreviation for the Cal Alumni Association, the official alumni organization of the University of California, Berkeley.
- F. None of above. chosen
- G. Unsure - the case is ambiguous/there is not enough information to decide.
NED2
Entity disambiguation (via description)
gpt-5-mini-2025-08-07
Target entity: CAA Target entity description: CAA (Certification Authority Authorization) is a DNS record type used to specify which certificate authorities are permitted to issue SSL/TLS certificates for a domain.
-
A.
CAA
CAA is the commonly used abbreviation for the U.S. Clean Air Act, a landmark federal law regulating air emissions to protect public health and the environment.
-
B.
CAA
CAA is the acronym for the Chinese Arctic and Antarctic Administration, the government body responsible for organizing and overseeing China’s polar research and expeditions.
-
C.
CAA
CAA is Japan’s national Consumer Affairs Agency responsible for protecting and promoting consumer rights and safety.
-
D.
CAA
CAA is the abbreviation for the Cal Alumni Association, the official alumni organization of the University of California, Berkeley.
-
E.
CAA
The CAA is a U.S. immigration law that provides a special pathway to lawful permanent residency for eligible Cuban nationals.
- F. None of above. chosen
Statements (49)
| Predicate | Object |
|---|---|
| instanceOf |
Certification Authority Authorization mechanism
ⓘ
DNS resource record type ⓘ |
| abbreviationOf | Certification Authority Authorization ⓘ |
| appliesTo |
domain names
ⓘ
subdomains ⓘ |
| belongsToProtocol | Domain Name System ⓘ |
| cannotRestrict | which specific end-entities receive certificates ⓘ |
| canRestrict | which CAs may issue certificates ⓘ |
| checkedDuring | certificate issuance ⓘ |
| configurationInterface | DNS zone configuration ⓘ |
| definedIn | RFC 6844 ⓘ |
| deploymentLocation | authoritative DNS zone for the domain ⓘ |
| enforcedBy | certificate authorities ⓘ |
| flag |
0
ⓘ
128 ⓘ |
| flagMeaning | 128: critical flag indicating unknown tags must cause issuance failure ⓘ |
| fullName | Certification Authority Authorization ⓘ |
| inheritanceDescription | Subdomains inherit CAA policy from parent domains unless overridden ⓘ |
| introducedYear | 2013 ⓘ |
| madeMandatoryForCAsBy |
CA/Browser Forum Baseline Requirements
ⓘ
linked to:
CA/Browser Forum
|
| policyScope | domain-level certificate issuance control ⓘ |
| queryClass | IN ⓘ |
| recordClass | resource record ⓘ |
| recordExample |
example.com. CAA 0 iodef "mailto:security@example.com"
ⓘ
example.com. CAA 0 issue "letsencrypt.org" ⓘ |
| recordTypeCode | 257 ⓘ |
| relatedTo |
HTTPS
ⓘ
TLS certificates ⓘ X.509 public key infrastructure ⓘ
linked to:
X.509 certificates
|
| securityProperty |
enables domain owners to express CA issuance policy
ⓘ
reduces risk of mis-issuance of certificates ⓘ |
| standardizedBy |
IETF
ⓘ
linked to:
Internet Engineering Task Force
|
| supportsInheritance | yes ⓘ |
| syntaxElement |
flag
ⓘ
tag ⓘ value ⓘ |
| tag | iodef ⓘ |
| tag |
issue
ⓘ
issuewild ⓘ |
| tagPurpose | iodef: specify contact or reporting URI for policy violations ⓘ |
| tagPurpose |
issue: authorize a CA to issue non-wildcard certificates
ⓘ
issuewild: authorize a CA to issue wildcard certificates ⓘ |
| updatedBy | RFC 8659 ⓘ |
| usedFor |
controlling issuance of SSL/TLS certificates
ⓘ
improving PKI security ⓘ specifying which certificate authorities may issue certificates for a domain ⓘ |
| valueType |
URI
ⓘ
domain name ⓘ email address (via mailto URI) ⓘ |
How these facts were elicited
The pipeline generated the facts above by prompting gpt-5.1 with this entity's name + description and the instruction below.
Instruction
You are a knowledge base construction expert. Given a subject entity and a description of it, return factual statements that you know for the subject as a JSON list of dictionaries(triples), where keys must be "subject", "predicate" and "object". The number of facts may be very high, between 25 to 50 or more, for very popular subjects. For less popular subjects, the number of facts can be very low, like 5 or 10. # Requirements - If you don't know the subject at all, return an empty list. - If the subject is not a named entity, return an empty list. - Include at least one triple where predicate is "instanceOf". - Do not get too wordy. - Separate several objects into multiple triples with one object.
Input
Subject: CAA Description of subject: CAA (Certification Authority Authorization) is a DNS record type used to specify which certificate authorities are permitted to issue SSL/TLS certificates for a domain.
Referenced by (1)
Full triples — surface form annotated when it differs from this entity's canonical label.