Apex or sub-domain accepted (e.g. www.example.com). The CAA lookup walks parent labels until a CAA record is found, per RFC 8659.

What good looks like

CAA

• An issue record listing only the CAs you actually use prevents accidental / malicious issuance from anyone else.
• An issuewild record can deny wildcard certs from being issued by some / all CAs.
• An iodef record (mailto: or https:) tells CAs where to report a violation attempt.
• Use 0 issue ";" to deny all certificate issuance (suitable for non-web domains).

HSTS preload

• HTTPS with a valid certificate.
• Redirect from HTTP to HTTPS on the same host.
• Strict-Transport-Security header with max-age=31536000 or longer, includeSubDomains, and preload.
• Submit at hstspreload.org once eligible. Submission ships with Chrome, Firefox, Safari, Edge.
• Be careful: preload is hard to undo — only enable it once every sub-domain is HTTPS-only.