CAA record

A DNS record naming the certificate authorities allowed to issue for this domain. Optional hardening: without it, any authority may issue.

• Help center

A CAA (Certification Authority Authorization) record lists the certificate authorities that may issue TLS certificates for your domain. Every public CA is required to check it before issuing: if your domain says only Let's Encrypt may issue, any other CA must refuse a request — even one from someone who has managed to pass domain validation by other means.

How SiteScan checks

The scan looks up CAA records on the registrable domain. If any exist, the row is green and shows how many. If none exist, the row reads "Missing" in a neutral state: without CAA every CA may issue, which is the default for most of the web and not a defect. CAA is optional hardening.

How to add it

Find out which CA issues your certificates today — the certificate issuer row shows it — and publish one record per authority, for example:

• example.com. CAA 0 issue "letsencrypt.org"
• example.com. CAA 0 issuewild ";" to forbid wildcard certificates
• example.com. CAA 0 iodef "mailto:security@example.com" for violation reports

Remember to include every service that obtains certificates for you: a CDN, a hosted shop or an email provider may use a different CA. A forgotten one will make its next renewal fail. Subdomains inherit the records unless they publish their own.