DNS | XB Field Notes

The authority lowers address A from TTL 8 seconds to 3 seconds while one resolver’s previously stored A answer continues its original received lifetime.

Lower DNS TTL before a move and budget the rollback cache window

Lower the TTL early if you expect to move a hostname.

An illustrative effective CAA policy, issue letsencrypt.org, branches into CAA permits for an authorized CA and CAA blocks for an unauthorized CA. Existing certificates are unchanged.

CAA records should authorize the issuer you actually use

CAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.