Certification Authority Authorization (CAA) Processing for Email Addresses
Extracted elements (16)
Other CAA Property Tags such as "issue" or "issuewild" are explicitly not extended to cover email certificates; a new dedicated tag "issuemail" is introduced instead. This avoids conflating TLS server certificate policy with S/MIME email certificate policy, allowing domains to set independent restrictions for each.
The "issuemail" sub-syntax is intentionally identical to that of the "issue" and "issuewild" Property Tags from RFC 8659. This design choice minimizes implementation complexity by reusing existing parser logic, and allows parameters (e.g., account identifiers) to be defined by individual CAs to further restrict issuance.
A domain that publishes only "issue" or "issuewild" CAA records but no "issuemail" records imposes no restriction on the issuance of email-certifying certificates. Implementors must not infer email issuance restrictions from non-issuemail properties.
When a single CAA RRSet is processed by multiple CAs for different certificate types, a critical "issue" Property Tag not understood by a CA will prevent that CA from issuing any certificate for the domain, including S/MIME certificates, even if a matching "issuemail" Property is present.
Any "issuemail" Property whose issuemail-value does not conform to the ABNF syntax defined in Section 3 SHALL be treated as if the issuer-domain-name in the issuemail-value is the empty string, effectively prohibiting issuance unless another conformant matching record exists.
If a certificate certifies more than one email address, the Certification Authority MUST perform the issuemail lookup and matching procedure separately for each email address being certified.
If no "issuemail" record in the Relevant RRSet has an issuer-domain-name that matches the Certification Authority's issuer-domain-name, then the Certification Authority MUST NOT issue the certificate.
If the Relevant RRSet is empty or contains no "issuemail" Properties, there are no restrictions on email certificate issuance for that domain. The presence of other Property Tags such as "issue" or "issuewild" does NOT restrict the issuance of certificates that certify email addresses.
Prior to issuing a certificate that certifies an email address, the Certification Authority MUST check for publication of a Relevant RRSet, and this discovery MUST be performed using the algorithm specified in Section 3 of RFC 8659.
The input domain to the CAA discovery algorithm SHALL be the domain "part" (per RFC 5322) of the email address being certified. If that domain is an Internationalized Domain Name containing U-Labels, all U-Labels MUST be converted to their A-Label representation (per RFC 5891) before discovery.
The "issuemail" Property Tag is a CAA DNS RR property that restricts which Certification Authorities may issue certificates containing the id-kp-emailProtection key purpose and at least one rfc822Name or id-on-SmtpUTF8Mailbox value in the subjectAltName extension. Its presence in a Relevant RRSet signals that the domain is requesting restrictions on email certificate issuance.
IANA has registered the "issuemail" tag in the "Certification Authority Restriction Properties" subregistry of the "Public Key Infrastructure using X.509 (PKIX) Parameters" registry group, with meaning "Authorization Entry by Email Address" and reference RFC 9495.
All security considerations from RFC 8659 (the core CAA specification) apply to this specification, including DNS security, DNSSEC validation, and the trust model for CAA record publication.
CAA Properties may have the "critical" flag set (flag value 128), requiring conforming CAs to process them. If a CA does not understand a critical Property, it MUST NOT issue the certificate. This mechanism can inadvertently block issuance if a CA supporting "issuemail" does not also support another critical Property Tag in the same RRSet.
The Certification Authority MUST NOT treat the presence of a matching "issuemail" Property alone as sufficient validation of the email address. The CA MUST still validate the email address according to its relevant policy documents and practice statements; CAA is a supplemental check only.
The "issuemail" Property Value follows the ABNF: issuemail-value = *WSP [issuer-domain-name *WSP] [";" *WSP [parameters *WSP]], where issuer-domain-name is one or more LDH labels separated by dots, and parameters is a semicolon-separated list of tag=value pairs. This syntax is identical to that of the "issue" and "issuewild" Property Tags defined in RFC 8659.