SC-085v2: CAs must check DNSSEC on CAA and domain validation

SC-085v2 makes CAs honor DNSSEC. Since 2026-03-15, when a domain is signed with DNSSEC, a publicly trusted CA must validate those signatures on its CAA lookups and on the DNS queries it makes for domain validation, and a validation failure blocks issuance.

What changed

SC-085v2 turned DNSSEC validation by CAs from optional into mandatory. It added rules to the Baseline Requirements that apply to the CA's Primary Network Perspective: DNSSEC validation must be performed on DNS queries for domain validation (§3.2.2.4) and for CAA records (§4.2.2.2); local policy may not switch it off; and DNSSEC errors such as SERVFAIL must not be read as "no CAA record, go ahead". The ballot argues that validated DNSSEC reduces the risk of DNS spoofing against CAs and gives domain owners a way to make validation provably secure.

Effective dates

The BR text became effective on 2025-07-21; the obligations themselves apply from 2026-03-15.

Who is affected

SC-085v2 only affects domains that have DNSSEC enabled, which the ballot describes as a small share of domains in TLS certificates. For them, a broken DNSSEC setup (expired signatures, a DS record left at the registry after changing DNS provider) now stops certificate issuance and renewal instead of being silently ignored.

What to do

If you use DNSSEC, monitor it: check signatures and the DS record at your registrar after every DNS provider change, and test with a validating resolver. If a renewal fails with a DNS or CAA error, check DNSSEC first. Pair it with CAA, and see SC-098v2, which makes CAs honor CAA account and method restrictions.