Does my domain have CAA records?

Short answer: a CAA record lists the certificate authorities allowed to issue HTTPS certificates for your domain. Without one, any authority may, which makes a wrongly issued certificate easier. With a wrong one, your own renewals can fail.

How to check it yourself

Look up your CAA records: dig CAA yourdomain.com.
If there are none, add records for the authorities you use (your host or CDN lists them).
If there are some, make sure they include the authority that issues your current certificate.

Why it matters

CAA records list which certificate authorities are allowed to issue HTTPS certificates for your domain. Without them, any certificate authority may issue one. With them, an authority that isn't listed should refuse. The flip side is that a CAA record that leaves out your actual provider can make certificate renewals fail.

Common causes

They were never added, which is the default for most domains.
The site moved to a new host or CDN that uses a different certificate authority.
A CAA record was copied from another domain with the wrong authorities.
Records exist on the main domain but conflict with a subdomain's provider.

What Preventionlabs shows

Every report's DNS section checks CAA. For example, from real reports: "No CAA record, so CAA doesn't restrict which certificate authorities may issue its certificates (RFC 8659)", or "CAA limits certificates to comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com".

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free