dotvitals

No CAA record says which authorities may issue certificates

InfoConfirmedQuick windns.records.caa-missing

What this check looks for

Any certificate authority in the world may issue a certificate for your domain. A CAA record names the ones you actually use, and every authority is required to check it before issuing.

Why it matters

CAA is the only mechanism that stops a mis-issued certificate before it exists rather than after. It costs one record and it is checked by every public CA on every issuance, including ones you have never heard of.

When the check passes, your report says: “CAA names the authorities allowed to issue your certificates”.

What it costs your score

This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.

Severity
info
Default confidence
confirmed
Status when triggered
info
Deduction
0 points
Family cap
none
Category
DNS
Module
Dns records
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Publish a CAA record listing the certificate authorities you use.

It is the only control that prevents a mis-issued certificate rather than detecting one afterwards.

  1. List every CA that issues for this domain today — including the one your hosting platform or CDN uses on your behalf, which is easy to forget.

  2. Publish an issue record for each. Add issuewild if you use wildcard certificates.

  3. Add an iodef record with a mailbox you read, so a CA can tell you about a refused request.

  4. Renew a certificate afterwards to confirm you have not locked out a CA you still need.

How to confirm it worked

  • dig +short CAA ‹domain› — expect your issue records

The configuration to publish
{{domain}}. 3600 IN CAA 0 issue "letsencrypt.org"

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

Generic DNS
‹domain›. 3600 IN CAA 0 issue "letsencrypt.org"
‹domain›. 3600 IN CAA 0 iodef "mailto:security@‹domain›"
Technical detail

No CAA record was found at ‹domain›. RFC 8659 §3 requires a CA to look up CAA at the requested name and climb the tree to the parent; if it finds a record that does not list it, it must refuse to issue. With no record at all, every CA is authorised by default. This is reported for information rather than as a fault: the absence of CAA is the internet's default and breaks nothing, but publishing one is a genuine improvement and takes a minute.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns records checkerBuild the fix

Other dns records checks