The Certification Authority Authorization (CAA) DNS resource record (RR) provides a mechanism for domains to express the allowed set of