SSL/TLS & Website
CAA record check
A CAA record names the certificate authorities allowed to issue certificates for your domain, and blocks the rest.
Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.
What we look at
We look up the CAA records for your domain and compare them with the authority that issued the certificate our scanner last read from your server. No CAA record is noted, not marked down; a record that leaves out the authority you actually use is a warning.
Why it matters to your business
Without CAA, any certificate authority in the world may issue a certificate for your domain. With it, a mistaken or fraudulent request to another authority is refused. If a CAA record excludes the authority you actually use, your next renewal fails.
How to fix it
- Publish CAA records for the authorities you use, for example: 0 issue "letsencrypt.org". List every authority your host and CDN use; if you are on Cloudflare with Universal SSL, Cloudflare adds the records for its own authorities once you publish any CAA record.
- Optionally add an iodef record with an email address. Authorities may use it to tell you about a request your CAA record refused, but they are not required to.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.
Keep an eye on it
A one-off check tells you how things stand today. On Starter and up, DomainGuard re-checks the domains it watches every day and alerts you in the app when something important changes, so you hear about it before a customer does.