Re: Enabling ACME CAA Account and Method Binding

[petercooperjr]

@rg305

Account restrictions are done at the DNS/domain level.
That simple little change could affect ALL users - which might not all be using the same LE account.
Which in the case of laaaarge users, might be thousands of systems.

I think generally, the people updating the CAA record would be doing do in order to try to break the integrations that aren't using the approved, central LE account. Like in this thread from a couple years ago, where the owners of the domain were trying to figure out how to stop the users that hosted subdomains from doing their own HTTP-01 challenge instead of going through the central system.