DNS · Fix guide
CAA is not configured
- CAA
- Certification Authority Authorization
CAA limits which certificate authorities may issue certificates for the domain.
What is CAA?
Certificate Authority Authorization is a DNS record that states which certificate authorities may issue TLS certificates for a domain. Certificate authorities are required to check it before issuance.
What to do next
- List the certificate authorities your site actually uses.
- Publish matching CAA issue records.
- Add issuewild if wildcard certificates need different handling.
How to verify the fix
Request the CAA record again and confirm every required issuer is allowed.
When this result may be wrong
CAA is optional. Its absence does not make an existing certificate invalid.
Ready to check again?
Check a domain
Run a fresh report after DNS caches and platform changes have had time to update.