CAA record checks
Understand a missing CAA policy, decide which certificate authorities should be named, and verify the published DNS change.
Reviewed
Check identity
dns.caa- Finding
- dns.caa.missing
- Severity
- informational
What the check observes
The code-owned DNS check asks for CAA records associated with the authorized domain target.
At least one observed record produces a passed check. No observed records produce the bounded finding `dns.caa.missing`.
IP-address targets are marked not applicable because CAA is a domain policy signal.
Why the result matters
CAA lets a domain publish which certificate authorities may issue certificates for it. A missing record means the domain has not expressed that authorization policy in DNS.
The finding is informational because certificate issuance still depends on the certificate authority’s validation and controls; absence alone does not show compromise.
How to investigate
- 1
Inventory the certificate authorities currently used for production, staging, managed hosting, CDN, and automated renewal.
- 2
Check the authoritative DNS zone and any inherited parent-domain CAA policy before adding a new record.
- 3
Confirm which teams or vendors depend on certificate issuance so the proposed policy does not interrupt renewal.
Remediation steps
- 1
Publish CAA records that name only the certificate authorities the organization intends to use.
- 2
Coordinate the policy with certificate automation, CDN, hosting, and disaster-recovery providers before enforcement.
- 3
Keep the policy maintainable: update it when certificate providers change and remove obsolete issuers after the transition is complete.
Verify the change
Query the authoritative DNS path after propagation and confirm the intended records are visible.
Confirm normal certificate renewal in a controlled environment, then run a new authorized scan to close or update the finding.
Limits of this check
- This check evaluates record presence, not whether the selected issuers match every organizational requirement or whether certificate-authority validation is infallible.
- It does not assess registrar security, DNS account access, DNSSEC deployment, or previously issued certificates.