CAA record missing
Check id: caa.missing · fix effort: low
What it means
Right now any certificate authority in the world may issue HTTPS certificates for your domain. A CAA record limits that to the ones you use. Optional hardening, nice to have, no rush.
The technical detail
No CAA at the apex (RFC 8659). One record shuts down mis-issuance through every CA you don't use.
How to fix it
- Publish CAA records for your CA(s), e.g.
0 issue "letsencrypt.org". - Optionally add
0 iodef "mailto:security@yourdomain.com"for violation reports.
Does your domain have this problem?
Run a free scan, takes about ten seconds.