diff --git a/dnsconfig.js b/dnsconfig.js
index 7d8c6ec..a1a3c77 100644
--- a/dnsconfig.js
+++ b/dnsconfig.js
@@ -1,6 +1,12 @@
 var DNS_DESEC = NewDnsProvider("desec");
 var REG_NONE = NewRegistrar("none");
 
+// Records
+var A_NATENOM_MAIN = function (name) { return A(name, "188.245.198.27") };
+var AAAA_NATENOM_MAIN = function (name) { return AAAA(name, "2a01:4f8:c013:3235::1") };
+var CAA_DEFAULT = CAA("@", "issue", "letsencrypt.org");
+
+// Addresses
 var NATENOM_MAIN = "natenom-main.natenom.org.";
 var WEBSYNTHESIS_MX = "mx.websynthesis.org.";
 
diff --git a/domains/natenom.org.js b/domains/natenom.org.js
index b1bcf7e..dca68b7 100644
--- a/domains/natenom.org.js
+++ b/domains/natenom.org.js
@@ -2,11 +2,13 @@ D("natenom.org", REG_NONE, DnsProvider(DNS_DESEC),
     DefaultTTL("1h"),
     NAMESERVER_TTL("1h"),
 
-    A("@", "188.245.198.27"),
-    A("natenom-main", "188.245.198.27"),
+    A_NATENOM_MAIN("@"),
+    A_NATENOM_MAIN("natenom-main"),
 
-    AAAA("@", "2a01:4f8:c013:3235::1"),
-    AAAA("natenom-main", "2a01:4f8:c013:3235::1"),
+    AAAA_NATENOM_MAIN("@"),
+    AAAA_NATENOM_MAIN("natenom-main"),
+
+    CAA_DEFAULT,
 
     CNAME("dev", "@"),
     CNAME("www", "@"),