CAA forbids every authority from issuing a certificate

MediumConfirmeddns.records.caa-empty-issue

What this check looks for

Your CAA record says that no certificate authority may issue for this domain. If that was deliberate, nothing is wrong. If it was not, your next certificate renewal will fail.

Why it matters

Renewals fail closed and usually fail silently: the automation retries, gets refused, and the certificate expires weeks later with no warning at the moment it breaks. The refusal happens at the CA, so nothing in your own logs explains it.

What it costs your score

When this check fails it removes 5 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.

It shares the dns.records.caa family ceiling of 15 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: confirmed
Status when triggered: warn
Deduction: 5 points
Family cap: dns.records.caa · 15
Category: DNS
Module: Dns records
Fix owned by: dns host
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Either confirm this is deliberate, or list the authority you actually use.

If it is not deliberate, the next renewal fails and the certificate expires.

Decide whether this domain should ever have a certificate. If it should not, this record is correct and you can dismiss the finding.
If it should, identify the CA that issues for it — including the one your platform uses on your behalf.
Replace the ; value with an issue record naming that CA.
Force a renewal to confirm the change works before the current certificate gets close to expiring.

How to confirm it worked

dig +short CAA ‹domain› — expect an issue record naming your CA

The configuration to publish

{{domain}}. 3600 IN CAA 0 issue "letsencrypt.org"

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

Every issue property at ‹domain› has the value ;, which RFC 8659 §4.2 defines as authorising no issuer at all. This is a valid and sometimes intentional configuration — a domain that must never have a certificate, such as one used only for mail routing or internal naming. It is a fault only if this domain does serve HTTPS or is expected to. Check when your current certificate expires before deciding.

Standards and references

RFC 8659 §4.2 — CAA issue property § 4.2

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns records checker Build the fix