禁止停用 DNSSEC 驗證

Prohibition on Disabling DNSSEC Validation

For all Domain Validation methods other than those listed in Section 4.2.2.2.3, and for all CAA record lookups, CAs MUST NOT use local policy to disable DNSSEC validation on any DNS query associated with the validation of domain authorization or control or with CAA record lookups performed by the Primary Network Perspective.

對於第 4.2.2.2.3 節所列之範圍外的所有網域驗證方法，以及所有 CAA 紀錄檢查，CA 不得（MUST NOT）針對主要網路視角（Primary Network Perspective）執行之任何與網域授權或控管權驗證相關、或與 CAA 紀錄檢查相關的 DNS 查詢，利用內部政策停用 DNSSEC 驗證。