dotvitals

The CAA reporting address is not a usable URL

LowConfirmedQuick windns.records.caa-iodef-invalid

What this check looks for

Your CAA record asks certificate authorities to report refused requests to an address they cannot use. The reports are simply not sent, so you never hear about an attempt to get a certificate for your domain.

Why it matters

The iodef address is how you find out that somebody tried to obtain a certificate for your domain and was refused — often the first sign of a takeover attempt. An unusable value turns that alarm off while leaving it visibly configured.

When the check passes, your report says: “The CAA reporting address is a URL authorities can use”.

What it costs your score

When this check fails it removes 3 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.

It shares the dns.records.caa family ceiling of 15 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.

Severity
low
Default confidence
confirmed
Status when triggered
warn
Deduction
3 points
Family cap
dns.records.caa · 15
Category
DNS
Module
Dns records
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Replace the iodef value with a mailto: address you actually read.

An unusable address means refused-issuance reports are never delivered.

  1. Choose a monitored mailbox — a security alias rather than a personal address.

  2. Publish it as 0 iodef "mailto:security@‹domain›".

  3. Remove the invalid value.

How to confirm it worked

  • dig +short CAA ‹domain› — expect a mailto: iodef value

The configuration to publish
{{domain}}. 3600 IN CAA 0 iodef "mailto:security@{{domain}}"

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

The iodef property at ‹domain› has the value ‹iodef value›, which is not a mailto: address or an http:/https: URL. RFC 8659 §4.4 defines the value as a URL and RFC 6546 as the reporting protocol for the HTTPS form; in practice mailto: is what CAs support most widely and has no endpoint of its own to break.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns records checkerBuild the fix

Other dns records checks