FmindSecurity guide
Allowed certificate providers (CAA)
A CAA record lists which organizations may issue HTTPS certificates for your domain, making a fraudulent certificate harder to obtain. It is optional, and a wrong record can stop your own certificate from renewing.
Who can help
Whoever manages your DNS, together with your web host
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- Read the DNS name saved with the report, then ask whoever manages your certificates to review aliases, inherited rules and every issuer needed for renewals. Don’t add a restrictive CAA record based only on the issuer seen here.
dig +time=3 +tries=1 CAA SAVED_DNS_QUERY_NAMEWhat to do
Without a CAA record, any certificate authority may issue certificates and your renewals keep working. If you add one, first ask your web host (and CDN, if any) which certificate authorities they use, and allow all of them, including for wildcard certificates. Never remove an issuer your providers rely on, or renewals will fail.
How to verify the change
Ask your web host to confirm the effective CAA rules, including any inherited from your main domain or aliases, and that your website certificate can still renew.
What this check can establish
We only record the CAA answer for this exact name. An empty answer may still inherit rules from your main domain. A record that only lists a contact address (iodef) does not restrict anything.