CAA records (certificate authority authorization)What it checks and how to fix it

What it checks

Looks up the CAA records on the domain. Passes when at least one issue or issuewild record names the certificate authorities allowed to issue certificates for it, warns when there are none (so any CA may issue one), and fails when the domain does not exist.

Why it matters

Without CAA, any of the more than one hundred publicly trusted certificate authorities can issue a valid certificate for your domain. A CA that is tricked or compromised can hand an attacker a certificate every browser accepts, which enables invisible man-in-the-middle attacks. A CAA record limits that exposure to the CAs you actually use, and costs nothing to add.

How to fix it

List the CA (or CAs) that issue your certificates and publish one issue record for each. Add issuewild if you use wildcard certificates, and an optional iodef address where CAs can report refused requests.

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issuewild "letsencrypt.org"
example.com.  3600  IN  CAA  0 iodef "mailto:security@example.com"

Common CA values: letsencrypt.org, digicert.com, sectigo.com, pki.goog (Google Trust Services), amazon.com (AWS Certificate Manager).

Cloudflare DNS: add a record of type CAA, choose the tag ("Only allow specific hostnames" for issue, "Only allow wildcards" for issuewild) and enter the CA domain. If Cloudflare issues your edge certificates, it adds the CAA records for its own CAs automatically once you publish any CAA record.

Check the result:

dig +short CAA example.com