← All checks

CAA record missing: which CAs can issue certificates for my domain?

CAA records low DNS · 3 of 100 points

What it inspects

CAA records on the domain, then each parent up to the organisational domain (RFC 8659 tree climb). Verdicts: PASS when CAA records are found. WARN when none are found (any CA may issue) or the records cannot be parsed. FAIL when a record has the critical flag (128) on a tag we do not recognise, because compliant CAs will then refuse to issue.

Why it matters

CAA tells certificate authorities which of them you permit to issue for your domain, narrowing the damage if someone tries to obtain a certificate fraudulently.

How to verify by hand

# bash
dig +short CAA example.com

# PowerShell
Resolve-DnsName -Name example.com -Type CAA

How to fix

Publish CAA records naming the CA or CAs you actually use.

  1. Publish records (this example allows Let's Encrypt only and sets a contact address for violations):

    example.com.  IN  CAA  0 issue "letsencrypt.org"
example.com.  IN  CAA  0 iodef "mailto:security@example.com"

  2. Add an issue line for each additional CA you use before enabling the restriction.

References

Scan your domain free