CAA record
The CAA record specifies which certificate authorities (like Let's Encrypt) are allowed to issue an SSL certificate for your domain. It's a …
Analyse my site for freeUnderstanding "CAA record"
A CAA (Certification Authority Authorization) record explicitly restricts, at the DNS level, which certificate authorities (CAs) are allowed to issue an SSL/TLS certificate for your domain. Without this record, any CA recognised worldwide can, in theory, issue a valid certificate for your domain — including a CA you never use and never authorised.
This is a low-cost preventive security mechanism: every major CA (including Let's Encrypt) has been required to honour CAA records since 2017, making it a de facto protection that a legitimate CA cannot bypass.
How TheSiteFuse checks "CAA record"
TheSiteFuse queries the root domain's CAA records. If present, up to 3 entries are displayed and the check passes. If absent, a warning is returned, explaining that any certificate authority can technically issue a certificate for the domain.
Why "CAA record" matters
- Fraudulent certificate issuance — without CAA, a compromised, poorly audited, or tricked CA (via an insufficiently rigorous domain validation) could issue a valid certificate for your domain without your consent, opening the door to sophisticated interception attacks (the user would see no security warning at all).
- No technical safeguard — without CAA, the only protection against unauthorised issuance rests on the rigour of each individual CA's validation process — a factor outside your control. CAA takes back that control at the DNS level, directly under your own authority.
- Non-compliance with current best practices — CAA is now considered a baseline measure by modern web security frameworks, on par with HSTS or a strong password policy.
Fix "CAA record" step by step
Identify your current CA
Check the issuer of your current SSL certificate (Let's Encrypt, Sectigo, DigiCert…) before configuring CAA, to avoid accidentally blocking your own renewals.
Add the record
# Authorise only Let's Encrypt Name: @ (root domain) Type: CAA Value: 0 issue "letsencrypt.org" # Authorise multiple CAs (one line per CA) 0 issue "letsencrypt.org" 0 issue "sectigo.com" # Optional: also restrict wildcard certificates 0 issuewild "letsencrypt.org" # Optional: receive a report on unauthorised attempts 0 iodef "mailto:security@yourdomain.com"
Verification
dig yourdomain.com CAA +short
No web server action is required after adding it — CAA is checked only by CAs at certificate issuance time, not by browsers visiting the site.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — CAA recordDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.