Finding: No CAA Record
This finding means your domain publishes no CAA (Certification Authority Authorization) record. With none published, any publicly trusted certificate authority may issue a certificate for your domain.
Last updated August 9, 2026.
What it means
CAA is a DNS record type that names which CAs are allowed to issue certificates for a domain. Every publicly trusted CA must check for it before issuing. No record published means no restriction — the default open state, not a broken configuration.
Why it matters
This is not an active vulnerability by itself — it removes a cheap safety net rather than opening a hole. A CAA record narrows which CA a mistaken or compromised issuance could plausibly come from, and, with an iodef tag, gives you a paper trail if another CA receives (and correctly refuses) a request for your domain.
What Nivaronix checks
Nivaronix performs a live CAA lookup on your domain. This finding fires when the lookup authoritatively returns no records — as opposed to a lookup that times out or fails, which is reported separately as inconclusive.
Example evidence (illustrative — not live scan data)
CAA example.com: no records published
How to fix it
- Identify the certificate authority you actually use (for example Let's Encrypt, DigiCert, Sectigo, or your hosting/CDN provider's managed TLS).
- At your DNS host, add a CAA record. Most DNS providers list CAA as a standard record type in the same "add record" screen used for A, TXT, or MX records — you typically pick "CAA" from the type dropdown, then fill flag, tag, and value fields.
- Add at minimum an
issuetag for your CA (0 issue "letsencrypt.org"), and anissuewildtag too if you use wildcard certificates. - Optionally add
0 iodef "mailto:[email protected]"to be notified of refused requests.
How to verify the fix
Re-run the CAA checker and confirm it now reports published records naming your CA.