CAA record present

What this means

Passing means your domain publishes a CAA record naming which certificate authorities may issue certificates for it. Failing means there is none, so any public authority may issue for your name if it can pass validation. This is a low-severity check: it is cheap insurance, not a sign that something is broken today.

How we test it

We run a CAA lookup on your domain. At least one CAA record with an issue tag is a pass. None is a fail; there is no warn state. We do not judge whether the authority named is the right one for your host, so check that yourself before adding one. This is a passive check.

Why it matters

Cheap protection against mis-issued certificates. An authority that is not named in your CAA record must refuse to issue for your domain, which closes off one route to a certificate someone else controls for your name. The one way this record causes harm is by omitting the authority your host renews through, which blocks renewal and leads to the expired-certificate outage the TLS check watches for. The Fix Kit does not cover CAA in depth, so the fix below stays short.

The fix

Add one CAA record on the apex in your DNS provider's dashboard (type CAA, name @, flags 0, tag issue, value the domain of the authority your host issues through, which the issuer line on your current certificate shows). Confirm with dig +short CAA YOUR_DOMAIN and then watch the next certificate renewal succeed before relying on it.

The full runbook is in the Fix Kit, Module 00.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change any DNS record. Run: dig +short CAA YOUR_DOMAIN and show me the output.
If it is empty, say so: any public certificate authority may issue for this name.
Run: echo | openssl s_client -connect YOUR_DOMAIN:443 -servername YOUR_DOMAIN 2>/dev/null | openssl x509 -noout -issuer and show me the issuer of the live certificate.
Tell me which authority the host currently issues through, based on that issuer.
Tell me what a CAA record permitting only that authority would look like, and stop before adding anything.
Finally run: dig +short CAA YOUR_DOMAIN | grep -c issue and show the count. Expected 1 or more once the record exists.

Copy the prompt