A missing CAA record means any public certificate authority may issue an SSL certificate for your domain. It's an optional safeguard. To add one, find which authority issued your current certificate, such as Let's Encrypt, then add a CAA record like 0 issue "letsencrypt.org" at your DNS host, with one record for each authority you use.
If your CyberVigil report says your domain has no CAA record, nothing is broken. A CAA record is an optional DNS setting that narrows down who can issue SSL certificates for your domain, and it takes about 15 minutes to add.
The one thing to get right is the name of your certificate authority. Scan your site below, and the SSL certificate result will show who issued your current certificate.
- Free check
- No signup
- No changes to your website
What does "missing CAA record" mean?
A certificate authority is a company that issues the SSL certificates behind the padlock in your browser. Let's Encrypt, Google Trust Services, Sectigo and GoDaddy are common ones.
A CAA (Certification Authority Authorization) record is a DNS record that names which of them may issue certificates for your domain. Every public authority has to check for it before issuing. RFC 8659 says that if a CAA record exists and doesn't allow the authority, it must not issue.
Our scan looks for CAA records on your website's hostname and each level above it, up to your main domain. We didn't find any, so we show this as "Worth improving."
Why does a CAA record matter?
Let's Encrypt explains that by default, "every public CA is allowed to issue certificates for any domain name in the public DNS," as long as it validates control of the domain. If any one of those authorities has a flaw in how it checks, your domain could be affected. A CAA record narrows the field to the authorities you use.
It's a small, optional safeguard. Visitors won't see any difference, and it isn't as urgent as an expiring certificate or missing email protection. The main risk is listing the wrong authority, which can stop your certificate from renewing.
Which certificate authority issues my certificate?
Look at the SSL certificate result in your CyberVigil report, or run the free SSL checker. It shows the issuer, for example "Issued by Let's Encrypt." You can also click the padlock in your browser and open the certificate details.
Then match the issuer to its CAA value:
| Issuer on your certificate | CAA value |
|---|---|
| Let's Encrypt | letsencrypt.org |
| Google Trust Services | pki.goog |
| Sectigo | sectigo.com |
| SSL.com | ssl.com |
| GoDaddy | godaddy.com |
For any other authority, look up its CAA domain in its help center or policy documents.
A CAA record on yourbusiness.com also covers every subdomain under it, so list every authority that issues certificates anywhere on your domain. That includes your main site and www, any online store, booking page or help desk on a subdomain such as shop.yourbusiness.com, and any CDN in front of your site. Platforms that run a subdomain for you often use their own authority, so run the SSL checker on each one.
Some hosts also switch authorities between renewals. cPanel's documentation says that if CAA records conflict with the authority it needs, you should add a record for that authority or remove the existing ones.
What CAA record should I add?
For a site whose certificate comes from Let's Encrypt, add this record:
- TypeCAAName / Host@Value0 issue "letsencrypt.org"Replace letsencrypt.org with your certificate authority if you use a different one.
The record has three parts. 0 is the flag, which Let's Encrypt says "should almost always just be the integer 0." issue is the tag that allows an authority to issue certificates. The value in quotes is the authority's domain.
If you use two authorities, add two records:
- TypeCAAName / Host@Value0 issue "letsencrypt.org"
- TypeCAAName / Host@Value0 issue "pki.goog"
The records are additive, so any authority named in an issue record is allowed.
Check your certificate and the rest of your site
Run a free scan to see your certificate, encryption settings, security headers and email setup in one plain-English report.
- Free check
- No signup
- No changes to your website
How do I add a CAA record at my DNS host?
Add the record wherever your domain's DNS is hosted. If you use two or more authorities, repeat the steps for each one.
Instructions for GoDaddy
- 1Sign in to your GoDaddy Domain Portfolio and select your domain.
- 2Select DNS, then Add New Record, and choose CAA as the type.
- 3Enter
@as the Name, choose0for Flag andissuefor Tag, and enterletsencrypt.orgor your authority in the Domain field. If your certificate comes from GoDaddy, entergodaddy.com. - 4You can also paste the full value into the optional CAA RDATA field, and GoDaddy fills in the other fields.
- 5Select Save.
- TypeCAAName / Host@Value0 issue "letsencrypt.org"
How do I check that it worked?
- Re-run your scan. The CAA result should list your record.
- If you're comfortable in a terminal,
dig yourbusiness.com caa +shortshows every CAA record, including any Cloudflare added for you. - Watch your next certificate renewal. If it fails with a CAA error, the authority your host uses isn't listed. Add it, or delete the CAA record while you sort it out.
What should you do next?
- Run the SSL checker on your main site and each subdomain, and note every issuer.
- Add one CAA record for each authority, then re-run the scan.
- Set a reminder to confirm your certificate renews normally next time.
- If your certificate is close to its expiry date, deal with that first using our guide to certificates expiring soon.
Common questions
Will adding a CAA record affect my current certificate?
No. Certificate authorities check CAA only when they issue a certificate, and RFC 8659 says browsers must not use CAA to validate certificates. The risk comes at your next renewal, so make sure the authority that renews your certificate is listed.
What if I use more than one certificate authority?
Add one CAA record for each. The records are additive, so any authority named in an issue record is allowed. GoDaddy's help center gives the same advice.
Do I need a separate record for wildcard certificates?
Usually not. Let's Encrypt says an issue record covers both normal and wildcard certificates unless you add other records. You only need issuewild if you want different rules for wildcards.
I use Cloudflare. Do I need to list its authorities?
Not if you use Cloudflare's Universal SSL. Cloudflare adds CAA records for the authorities it uses as soon as you add any CAA record, though they don't appear in your dashboard. You can see them by running dig yourbusiness.com caa +short.
My website is on Wix. Can I add a CAA record?
No. Wix says it doesn't support CAA records, and if your domain is connected by pointing, Wix asks you to remove any CAA record at your domain host. On Wix, you can leave this finding as it is.
What happens if I get the record wrong?
Your next certificate renewal can fail, and your certificate could then expire. If a renewal fails after you add CAA, correct the authority's domain or delete the record. Deleting it returns you to the default, where any authority may issue.
Sources
- RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record (IETF / RFC Editor)
- Certification Authority Authorization (CAA) (Let's Encrypt)
- Add CAA records (Cloudflare Docs)
- Add a CAA record (GoDaddy Help)
- DNS records for security (Squarespace Help Center)
- Request: Supporting CAA Records (Wix Help Center)
- SSL/TLS Status (cPanel & WHM Documentation)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.