DNSSEC and CAA: Stop Attackers From Hijacking Your Domain

Quick answer: DNSSEC signs your DNS records so resolvers reject forged answers, stopping cache-poisoning redirects. CAA records restrict which certificate authorities may issue HTTPS certificates for your domain, blocking attacker-obtained certs. Both are free: enable DNSSEC at your DNS host, publish the DS record at your registrar, then add CAA records naming only the CAs you use.

By Daniel A · Kraftwire Software

DNSSEC and CAA records are the primary defense against domain hijacking and rogue certificate issuance. DNSSEC (Domain Name System Security Extensions) uses cryptographic signatures to ensure DNS responses are authentic and haven't been tampered with by attackers. CAA (Certification Authority Authorization) records are DNS entries that specify which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for your domain. Together, they prevent attackers from redirecting your traffic or impersonating your site with a valid-looking certificate.

Why Is DNS the Soft Underbelly of Your App?

DNS is the system that turns yourapp.com into an IP address. It also routes your email via MX records, proves domain ownership for CAs, and anchors nearly every integration you connect. If an attacker can forge or tamper with DNS answers for your domain, they don't need to break into your app's code or server. They simply point your visitors to a malicious server they control.

The classic version of this attack is DNS spoofing, also known as cache poisoning. Resolvers (the servers your ISP or network uses to look up domains) cache answers to maintain speed. In a cache poisoning attack, an attacker tricks a resolver into storing a forged answer. Consequently, yourapp.com resolves to the attacker's server for every user on that network until the cache entry expires. The original DNS protocol, designed decades ago, had no mechanism to distinguish a legitimate answer from a forged one; it trusted whatever arrived first.

Many of these risks stem from the underlying infrastructure, including DNS misconfigurations that leave the door open for hijacking. When you use vibe-coding tools like Lovable, Bolt.new, or Cursor, you are often moving fast and deploying to subdomains or new domains frequently. This speed can lead to "DNS debt" · records left pointing to old Vercel projects or Netlify instances that you no longer control.

What Does DNSSEC Actually Do?

DNSSEC adds a layer of trust to the DNS by providing cryptographic authentication of DNS data. When your domain is signed, each set of records is signed with a private key, and the matching public key is published in the DNS. A chain of trust runs from the root zone down through your top-level domain (TLD) like .com or .io to your specific domain.

When a validating resolver looks up your domain, it checks these signatures against the chain of trust. If the signatures are valid, it returns the answer with the AD flag (Authenticated Data). If an attacker attempts to inject a forged record, the signature will not match, validation will fail, and the resolver will reject the answer entirely. This prevents the poisoned entry from ever reaching the user.

The limit worth understanding

DNSSEC authenticates DNS data to prove an answer genuinely came from your domain and wasn't altered. However, it does not encrypt the data. DNS queries and responses are still visible in plaintext unless you also use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT). Think of DNSSEC as a wax seal on an envelope: it doesn't stop people from reading the letter if they intercept it, but it proves the letter hasn't been swapped or tampered with since it was sent.

How CAA Records Control Certificate Issuance

DNSSEC protects the DNS answers, but CAA records protect the issuance of the certificates that enable HTTPS. By default, any public Certificate Authority (CA) can issue a certificate for your domain if someone passes their validation checks. If an attacker hijacks your DNS briefly or exploits a weak validation path, they can obtain a legitimate certificate and impersonate your site.

A CAA record (defined in RFC 8659) is a DNS record that explicitly lists which CAs are authorized to issue certificates for your domain. If your CAA record only names Let's Encrypt and an attacker tries to get a certificate from a different CA, that CA must refuse the request.

CAA records use three primary tags:

• issue: Authorizes a CA to issue regular certificates.
• issuewild: Authorizes the issuance of wildcard certificates (e.g., *.yourapp.com).
• iodef: Provides a contact (email or URL) where CAs can report policy violations.

A typical configuration looks like this:

If you use multiple services · for example, Vercel for your frontend and AWS for your backend · you may need to list multiple CAs. Vercel typically uses Let's Encrypt, while AWS might use Amazon Trust Services. Failing to list all active CAs will result in failed certificate renewals, which can take your site offline.

How Do You Enable DNSSEC and CAA, Step by Step?

To enable DNSSEC, you must coordinate between your DNS host (where your records live) and your registrar (where you bought the domain).

Cloudflare (as your DNS host)

• Log in to the Cloudflare dashboard.
• Navigate to DNS > Settings.
• Click Enable DNSSEC. Cloudflare will generate a DS record.
• Copy the Key Tag, Algorithm, Digest Type, and Digest.
• Go to your registrar (e.g., GoDaddy, Namecheap) and publish this DS record to complete the chain of trust. If you use Cloudflare Registrar, this is done automatically.

Namecheap (Registrar and DNS)

• Go to your Domain List and click Manage.
• Select the Advanced DNS tab.
• Find the DNSSEC section and toggle it to ON. Namecheap handles the DS record publication automatically if you use their BasicDNS or PremiumDNS.

Porkbun (Registrar and DNS)

• Open Domain Management and click Details for your domain.
• Find Porkbun DNSSEC and click the toggle.
• If you use external nameservers, use the Registry DNSSEC option to paste the DS record provided by your DNS host.

Vercel (Important Note)

Vercel's nameservers currently do not support DNSSEC. If your domain points to Vercel's nameservers, you must ensure DNSSEC is disabled at your registrar to avoid resolution failures. To use DNSSEC with a Vercel app, manage your DNS through a provider like Cloudflare, enable DNSSEC there, and point your A/CNAME records to Vercel. This "proxy" setup allows you to keep the security benefits of DNSSEC while using Vercel's hosting.

Advanced Protection: AEO and AI Visibility

For modern apps built with tools like Lovable or Bolt.new, security is only half the battle. You also need to ensure your site is visible to AI agents. This is known as Answer Engine Optimization (AEO). Just as DNSSEC ensures the integrity of your domain, AEO ensures the integrity of how AI models perceive your site.

Speed is a critical factor not just for users, but for AI crawlers. If your site is slow or lacks proper meta tags for SEO, AI engines may fail to index your content accurately. You can check your site's AI readiness with our AI visibility tool. SimplyScan evaluates your site's performance and SEO signals in ~30 seconds, giving you a clear picture of how AI agents see your application.

Protecting Against Injection and Environment Leaks

While DNSSEC and CAA protect your domain's perimeter, you must also secure the application layer. For developers using Hapi.js, preventing SQL injection is paramount. Always use parameterized queries or an ORM that handles escaping automatically. For more details, see our guide on Hapi.js injection prevention.

Furthermore, never expose secrets in your client-side code. SimplyScan frequently detects exposed API keys and environment variables in AI-generated code. If you've accidentally committed secrets to your repository, follow our guide on how to remove secrets from git history. AI-generated code is particularly prone to "hallucinating" secure configurations that aren't actually there, such as assuming a .env file is automatically ignored by Git.

Dead Infrastructure Hijacking (DIH)

Dead Infrastructure Hijacking occurs when an organization abandons a service or a subdomain but leaves the DNS records pointing to a decommissioned resource (like an old S3 bucket, a GitHub Pages site, or a Vercel project). Attackers can claim that abandoned resource and take control of your subdomain.

For example, if you have a CNAME record for test.yourapp.com pointing to my-old-app.vercel.app, and you delete the project in Vercel but keep the DNS record, an attacker can create a new Vercel project named my-old-app and effectively hijack your subdomain. DNSSEC doesn't prevent this because the DNS record itself is "validly" signed; the problem is where it points. Regular uptime monitoring and DNS audits can help you identify and prune "dead" records before they are exploited.

The Role of SimplyScan in Your Security Workflow

SimplyScan is designed for the modern "vibe-coding" era. When you build an app in minutes using Bolt.new or Lovable, you need a security tool that works just as fast. Our free site health scanner grades 8 dimensions in one pass:

• Security: Detects exposed API keys, missing Supabase RLS, and XSS risks.
• Speed: Measures Core Web Vitals and performance bottlenecks.
• SEO: Checks for missing meta tags and crawlability.
• AI Visibility (AEO): Ensures your site is optimized for AI agents.
• Accessibility (WCAG): Scans for contrast issues and ARIA labels.
• GDPR/Compliance: Identifies missing privacy signals.
• Domain Health: Checks for DNSSEC, CAA, and hijacking risks.
• Email Security: Validates SPF, DKIM, and DMARC records.

The scan takes ~30 seconds and requires no signup. It is the fastest way to verify that your DNSSEC and CAA records are correctly implemented and that your app isn't leaking sensitive data.

Why Email Security (SPF/DKIM/DMARC) Matters Too

DNSSEC protects your domain's resolution, but your domain's reputation is also tied to your email. If you don't have SPF, DKIM, and DMARC records, attackers can spoof your domain to send phishing emails. This is often the first step in a larger attack that ends in domain hijacking.

• SPF (Sender Policy Framework): Lists the IP addresses authorized to send email for your domain.
• DKIM (DomainKeys Identified Mail): Adds a digital signature to your emails, proving they weren't altered.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving servers what to do if SPF or DKIM fails (e.g., p=reject).

SimplyScan's free scan includes a check for these records. If you are building an app that sends transactional emails (like password resets), these records are mandatory for deliverability and security.

Common Pitfalls and How to Avoid Them

1. The "Broken Chain" Problem

The most common DNSSEC failure happens when a user enables DNSSEC at their DNS host but forgets to update the DS record at their registrar. This creates a "broken chain of trust." Validating resolvers will see that the TLD (like .com) expects a signed zone, but the signatures provided by your DNS host won't match the DS record. The result? Your site goes offline for anyone using a secure resolver (like Google DNS or Cloudflare DNS).

2. CAA Over-Restriction

If you add a CAA record for letsencrypt.org but your hosting provider uses digicert.com for its automated certificates, your next renewal will fail. Always check your current certificate's "Issuer" field in your browser's security tab before setting your CAA policy.

3. Subdomain Takeover

As mentioned in the Dead Infrastructure section, DNSSEC and CAA do not protect against subdomains pointing to deleted external resources. You must combine DNS security with active uptime monitoring to ensure every record points to a live, controlled resource.

4. Ignoring TTL (Time to Live)

When making changes to DNSSEC or CAA, remember that DNS records are cached. If you make a mistake and then fix it, it may take hours for the fix to propagate. Always lower your TTLs before making major DNS changes, then raise them back up once you've verified the new configuration.

Next Steps for Your App

• Enable DNSSEC: Follow the steps for your specific registrar and DNS host. Ensure the DS record is correctly published.
• Add CAA Records: Limit certificate issuance to the specific CAs you use (e.g., Let's Encrypt, ZeroSSL, or Amazon).
• Verify Your Records: Use the DNS Security Checker to ensure your records are valid and the chain of trust is intact.
• Run a Full Scan: Go to SimplyScan.io and run a free scan. It will check for DNSSEC/CAA and also look for security headers, CSRF protection gaps, and exposed environment variables.
• Get a Badge: Once your site is secure, you can display a verified security badge to build trust with your users.
• Pro Monitoring: For production apps, consider Pro Monitoring ($24/month) for scheduled rescans and instant Slack alerts if your DNSSEC status changes or a new vulnerability is detected.

Conclusion

DNS is the foundation of your application's identity. In an era where AI can build and deploy apps in seconds, the risk of misconfiguration is higher than ever. DNSSEC and CAA records provide a critical safety net, ensuring that your users reach your real server and that only you can issue certificates for your domain. By spending 10 minutes today to configure these free tools, you protect your app from some of the most damaging (and hardest to detect) attacks on the web.

FAQ

Is DNSSEC worth enabling for a small website?

Yes. Small apps are attractive targets precisely because their domains are usually unprotected. A hijacked domain lets an attacker redirect users to a cloned login page, receive your password-reset emails, and present a valid-looking certificate. DNSSEC and CAA are free, take minutes to configure, and are set-and-forget, making them among the highest-leverage security wins available to a solo builder.

Does DNSSEC encrypt my DNS traffic?

No. DNSSEC authenticates DNS data, proving an answer genuinely came from your domain and was not altered in transit, but queries and responses remain visible on the wire. Confidentiality is the job of HTTPS and encrypted DNS transports like DoH. You need both DNSSEC and TLS because they solve different problems: one protects DNS integrity, the other encrypts the connection.

Can a CAA record break my SSL certificate renewal?

Yes, if it is incomplete. Compliant certificate authorities must refuse issuance when your CAA record does not list them, so omitting the CA your host or CDN uses behind the scenes means the next automated renewal silently fails and your certificate expires. Before locking down CAA, check which CA issues your current certificate and list every CA your providers actually use.

What happens if my DS record doesn't match my DNS host's key?

Resolution breaks. Validating resolvers treat your domain's answers as invalid and refuse to serve them, which can take your site offline for a large share of users. Always copy the key tag, algorithm, digest type, and digest exactly from your DNS host, and if DNSSEC shows as broken right after enabling, allow propagation time before troubleshooting.

Does Vercel support DNSSEC?

No. Vercel's nameservers do not support DNSSEC, and if your registrar has DNSSEC enabled while the domain points at Vercel nameservers, resolution can fail until you disable it. To get DNSSEC on a Vercel-hosted app, host your DNS on a provider that signs zones, such as Cloudflare, publish the DS record at your registrar, and point your app records at Vercel from there.

How long does it take for DNSSEC to become active?

Usually minutes to a few hours. The DNS host signs the zone immediately, but the DS record must propagate to the top-level domain and old cached records must expire, which depends on TTLs. Namecheap quotes about an hour and GoDaddy up to 90 minutes. Verify afterwards with a checker such as SimplyScan's free DNS Security Checker rather than assuming it worked.