Skip to content
DomainGrade

What we checkDNS hygieneDN-03

CAA record

CAA names which certificate authorities may issue certificates for your domain.

Area
DNS hygiene
Check
DN-03
Included
Free in every scan

What we check

We look up your CAA records and list the authorised issuers. Informational.

Why it matters

Any public CA can issue a certificate for any domain unless you say otherwise. CAA is how you say otherwise.

It turns 'any of a hundred authorities could mis-issue for us' into 'only the one we use'.

It is also cheap insurance against a mistake rather than an attack. Most mis-issuance is somebody at your own company using a different CA for a subdomain, and CAA turns that into a clear error instead of a certificate nobody knew existed.

How to fix it

  1. 1

    Publish a CAA record naming the CA you actually use.

  2. 2

    List every CA you use, not just the main one — a CDN or a mail provider may issue its own certificates for a subdomain.

  3. 3

    List every CA you use, not just the main one — a CDN or a mail provider may issue its own certificates for a subdomain.

  4. 4

    Add iodef= alongside it so a CA can tell you when a request is refused; the refusal itself is worth knowing about.

A CAA record
yourcompany.com.  IN CAA  0 issue "letsencrypt.org"

Common questions

What happens if I change CA?
Issuance fails until you update the record. Add the new one before you migrate.
Does it stop a compromised CA?
It stops an honest CA from mis-issuing, which is the common case. A genuinely compromised CA can ignore it — that is what certificate transparency monitoring is for.
Do I need one per subdomain?
No, CAA is inherited down the tree unless a subdomain has its own.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other dns hygiene checks