joonak

Check CAA specification: https://tools.ietf.org/html/draft-ietf-acme-caa-02 DNSSEC gives you additional security against BGP hijacking, if you use CAA records with DNS set as the only ACME verification method, or you limit the ACME account-uris that can renew the certificate.