Before a Certificate Authority (CA) can issue a TLS/SSL certificate for your domain, they must check, process, and abide by the domain's DNS Certification Authority Authorization (CAA) resource records (RRs).