CAA forbids every authority from issuing a certificate
Updated
Fewer than 1% of the 289 domains we could check get a warning for this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Your CAA record says that no certificate authority may issue for this domain. If that was deliberate, nothing is wrong. If it was not, your next certificate renewal will fail.
Why it matters
Renewals fail closed and usually fail silently: the automation retries, gets refused, and the certificate expires weeks later with no warning at the moment it breaks. The refusal happens at the CA, so nothing in your own logs explains it.
When the check passes, your report says: “Your CAA records leave at least one authority free to issue”.
What it costs your score
When this check fails it removes 5 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.records.caa family ceiling of 15 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 5 points
- Family cap
- dns.records.caa · 15
- Category
- DNS
- Module
- Dns records
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Either confirm this is deliberate, or list the authority you actually use.
If it is not deliberate, the next renewal fails and the certificate expires.
Decide whether this domain should ever have a certificate. If it should not, this record is correct and you can dismiss the finding.
If it should, identify the CA that issues for it — including the one your platform uses on your behalf.
Replace the
;value with anissuerecord naming that CA.Force a renewal to confirm the change works before the current certificate gets close to expiring.
How to confirm it worked
dig +short CAA ‹domain› — expect an issue record naming your CA
{{domain}}. 3600 IN CAA 0 issue "letsencrypt.org"A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Every issue property at ‹domain› has the value ;, which RFC 8659 §4.2 defines as authorising no issuer at all. This is a valid and sometimes intentional configuration — a domain that must never have a certificate, such as one used only for mail routing or internal naming. It is a fault only if this domain does serve HTTPS or is expected to. Check when your current certificate expires before deciding.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.