# Does your domain say which authorities may issue its certificates?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The CAA check reads whether your domain publishes a CAA record. Here is what it limits, why a missing one is informational, and how to add it.

The CAA check reads whether your domain publishes a CAA record, which names the certificate authorities allowed to issue certificates for it. Other authorities should refuse to issue one.

## What does this check look at?

It looks at whether your domain publishes a CAA record naming the certificate authorities that may issue certificates for it. Cloudflare says a CAA record specifies which certificate authorities are allowed to issue certificates for a domain.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Pass | A CAA record applies to your site. | Keep it in step with the authorities you really use. |
| Not tested | No CAA record applies, or the lookup did not complete. | Optional. Add one naming your certificate authorities. |

It does not test what an authority would do, and a missing record is informational. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Anyone sending mail or resolving your domain |
| The protection that should stop it | A DNS setting read from public records |
| What is reached | Email and DNS trust decisions |
| What follows | A hardening gap for your domain |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A04:2025` Cryptographic Failures |
| CWE | `CWE-295` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

List every service that gets certificates for your domain before you add the record, or one of them will stop renewing.

:::fix-prompt any
Help me add CAA records to my domain. Find out which certificate authorities issue my certificates today (check my host, CDN and any other service that serves my domain over HTTPS, such as Vercel, Netlify, Cloudflare or my email provider). Write one CAA issue record per authority, plus an iodef record with my security email, and tell me what to paste into my DNS settings.
:::

## How to check

Say Atlas, our example app at `atlas.example`, gets certificates from its host and its CDN. A CAA record naming both authorities keeps renewals working and tells every other authority to refuse.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Can a CAA record break certificate renewal?

Yes, if you leave out an authority one of your services uses. That service then fails to renew, so list them all first.

### Does a CAA record stop a stolen certificate from working?

No. It only asks authorities not to issue new ones. Certificate logs help you spot one that was issued anyway.

## Sources

- [Certification Authority Authorization (CAA) records](https://developers.cloudflare.com/ssl/edge-certificates/caa-records/), Cloudflare docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07