Add a CAA record
DNS · about 5 min
In plain words
A CAA record lists the certificate authorities allowed to issue HTTPS certificates for your domain. Others must refuse.
What can go wrong
Low on its own, but it narrows the chance of a mis-issued certificate for your domain.
How to fix it
Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.
DNS record
Type: CAA Name: @ Flags: 0 Tag: issue Value: letsencrypt.org
Type: CAA Name: @ Flags: 0 Tag: iodef Value: mailto:security@yourdomain.comBehind Cloudflare
# Cloudflare Universal SSL may use several CAs. Allow all of them, e.g.:
0 issue "letsencrypt.org"
0 issue "pki.goog"
0 issue "ssl.com"
0 issue "digicert.com"Before you change anything: A wrong CAA record blocks your own certificate renewals. List EVERY CA your hosting/CDN uses before adding one. Add it in your DNS provider (Cloudflare → DNS → Records, cPanel → Zone Editor, or your registrar). Changes usually take effect within minutes, sometimes up to a few hours.
Check that it worked
Re-run the ProbeHunt check.