Missing DNS CAA Record (CA Authorization)
No DNS CAA record restricts which certificate authorities can issue certificates for your domain.
What is Missing DNS CAA Record (CA Authorization)?
A CAA (Certification Authority Authorization, RFC 8659) record is a DNS entry that tells the world which Certificate Authorities are allowed to issue TLS certificates for your domain. Since 2017, every public CA is required by the CA/Browser Forum to check your CAA record before issuing — and to refuse issuance if your record does not authorize them. Without a CAA record, every CA on the planet can issue a certificate for any of your subdomains, whether that matches your intent or not. CAA also supports an iodef property that tells CAs where to report misissuance attempts against your domain — free visibility into someone trying to obtain an unauthorized certificate.
Why It Matters to Your Business
The risk is low-probability but high-impact: a misissued certificate enables convincing phishing on your own subdomains or active interception of traffic. Certificate misissuance has happened to major CAs (the 2017 Symantec distrust event de-authorized an entire CA). A CAA record narrows your issuance surface from hundreds of CAs to the one or two you actually use, and iodef gives you an early-warning channel. It is a five-minute, zero-cost hardening step that auditors increasingly expect to see.
How to Fix It
Add a CAA record at your DNS provider (Cloudflare, Route53, GoDaddy, and all major providers support it in their dashboard). Allow only your actual CA, e.g. for Let's Encrypt: yoursite.com. CAA 0 issue "letsencrypt.org" For multiple CAs (e.g. also DigiCert for EV): yoursite.com. CAA 0 issue "letsencrypt.org" yoursite.com. CAA 0 issue "digicert.com" Add an incident-reporting address: yoursite.com. CAA 0 iodef "mailto:[email protected]" Verify from a terminal: dig CAA yoursite.com +short IMPORTANT: list your current CA first — a CAA record that omits the CA you actually use will break your next certificate renewal.
Frequently Asked Questions
What is a DNS CAA record?
It is a DNS record that declares which Certificate Authorities are allowed to issue TLS certificates for your domain. All public CAs are required to check it before issuing — if your record does not authorize them, they must refuse.
Can a CAA record break my certificate renewal?
Only if it omits the CA you actually use. Check who issued your current certificate (click the padlock in your browser), list that CA in your CAA record, and renewals continue unaffected.
How do I check if my domain has a CAA record?
Run: dig CAA yoursite.com +short — or run a free scan on this page and our DNS scanner will report it alongside DNSSEC and other DNS posture checks.
Technical Classification
| OWASP Category | A05:2021 — Security Misconfiguration |
| CWE ID | CWE-295: Improper Certificate Validation |
| Detected By | doh_caa, dns scanner(s) |
| Severity Level | low |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our doh_caa, dns scanner checks for this issue automatically.
Scan My Website Free