Theme
Light Dark System
Sign in Start free
Features Free tools Checks Sample report Pricing
Sign in
DNS & attack surface

CAA record restricts certificate issuance

DNS hygiene, subdomains, takeover risks and domain registration.

Why it matters

Any of the hundreds of certificate authorities may issue a certificate for your domain; CAA limits that to the ones you actually use, reducing mis-issuance risk.

How to fix it

Quick fix · under 1 hour
  1. Find which CA issues your certificates (shown in the certificate details).
  2. Publish a CAA record naming it.
DNS CAA (Let's Encrypt)
example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:[email protected]"

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free