With the approval of ballot 187 the Certificate Authorities must check and respect the CAA records that are found in the DNS of a domain. This additional check is active since September 17, 2017. CAA stands for Certification Authority Authorization and is a standard designed to help the owners of a domain by preventing the issuance of rogue or unauthorized SSL/TLS certificates for that domain.
There are many things told about zone transfers and why it is important to restrict the use of zone transfers. The DNS zone can contain sensitive information like DKIM keys or information about the internal infrastructure. And because of this I actually thought it was not so common anymore.
Many services are depending on DNS and it is getting more and more used for serving information. Sometime’s companies are putting some inside information in their DNS that others do not need to know.
Maybe the information that is in the DNS looks innocent, but if you are a target for criminal hack...
Web application developers will all know, never to trust the input of the users of the web application. But what if you do not really know what they are submitting? While investigating some form fields in our application, I came across a form for checking a certificate signing request (CSR) witch you need to order a SSL / TLS certificate.