Innovate Bank needs to restrict which certificate authorities can issue certs for their public domain 'banking-innovate.com'. They want to publish DNS records that explicitly authorize only DigiCert to issue certificates. Which Azure DNS change achieves this requirement?

A CAA (Certificate Authority Authorization) record allows a domain owner to specify which certificate authorities (CAs) are authorized to issue certificates for that domain. By creating a CAA record with the 'issue' tag and the value 'digicert.com' at the zone apex, Innovate Bank explicitly restricts certificate issuance for 'banking-innovate.com' to DigiCert. Other CAs are then obligated to check this record and refuse to issue certificates if they are not listed. A TXT record is a general-purpose text record and does not inherently convey certificate issuance authorization to CAs. An NS record delegates DNS resolution, not certificate issuance authorization. An A record maps a domain name to an IP address and is unrelated to CA authorization.