Is your domain protected with CAA and DNSSEC?
Whether your domain has a CAA record, which limits the certificate authorities that may issue certificates for it, and whether it is signed with DNSSEC.
Why it matters
These are extra layers rather than urgent fixes. CAA makes it harder for someone to get a certificate for your domain from an authority you do not use. DNSSEC protects visitors from forged DNS answers that could send them to the wrong server.
How a survey checks it
Passive check: part of every free survey.
We look up your domain's CAA records and ask a public DNS resolver whether the domain is DNSSEC-signed. Both are reported for information.
How to fix it
- Add a CAA record naming the certificate authority your host uses, for example Let's Encrypt.
- Switch on DNSSEC at your DNS provider. On Cloudflare and many registrars it is one setting plus a record at the registrar.
Prefer us to do it? Ask for a fix quote
Common questions
Will a CAA record break my certificate renewals?
Only if you leave out the authority your host uses. Check which one issues your current certificate before adding it.
Is DNSSEC required?
No, which is why this is information only. It is a sensible extra when your DNS provider makes it easy.