What it checks
Whether the domain publishes CAA records, which name the certificate authorities allowed to issue certificates for it.
A pass means: CAA records restrict which certificate authorities may issue certificates.
Possible findings
No CAA records
Severity: LowConfidence: ConfirmedKind: Recommended hardening
What we found
The domain does not publish CAA records.
Why it matters
Without CAA, any public certificate authority may issue certificates for the domain. CAA narrows that to the authorities you actually use, reducing the impact of mis-issuance.
How to fix it
Add a CAA record naming the certificate authorities you use, for example example.com. CAA 0 issue "letsencrypt.org". Check which authorities issue your current certificates first, so renewals keep working.