SSL/TLS & Website
CAA record check
A CAA record names the certificate authorities allowed to issue certificates for your domain, and blocks the rest.
Check this on your own domain now. It is free with a DomainGuard account, reads only public records, and gives you a report you can send to whoever runs your website.
What we look at
We look up the CAA records for your domain and compare them with the authorities that issued your current certificates.
Why it matters to your business
Without CAA, any certificate authority in the world may issue a certificate for your domain. With it, a mistaken or fraudulent request to another authority is refused. If a CAA record excludes the authority you actually use, your next renewal fails.
How to fix it
- Publish CAA records for the authorities you use, for example: 0 issue "letsencrypt.org".
- Add iodef with an email address to hear about refused requests.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.
Keep an eye on it
A one-off check tells you how things stand today. On Starter and up, DomainGuard re-checks the domains it watches every day and alerts you in the app when something important changes, so you hear about it before a customer does.