Security
How to Set Up CAA Records
CAA (Certification Authority Authorization) records tell certificate authorities which of them is allowed to issue certs for your domain. Without CAA, any CA can issue a cert — a known attack vector. With CAA, an unauthorized CA must refuse the request.
Try our SSL checkerPublish CAA records at the apex
Add CAA records at yourdomain.com (or the highest level you control). Example: 0 issue letsencrypt.org — only Let's Encrypt may issue. Add 0 issuewild letsencrypt.org if you also use wildcards.
Restrict to multiple CAs
Publish multiple CAA records to allow multiple authorized CAs: 0 issue letsencrypt.org 0 issue digicert.com. A CA not in the list must refuse.
Set up incident reporting
Add 0 iodef mailto:User to receive notifications when an unauthorized CA tries to issue (some CAs send these reports).
Use the critical flag carefully
0 means non-critical; 128 means critical. With critical CAs that don't recognize a tag will refuse. Recommended: keep critical=0 unless you know what you're doing.
Want to verify your setup?
Run the check now