agentsiteaudit · Checks · Domain and email

CAA record: choose who can issue certificates for your domain

A CAA record is a line in your domain's DNS saying which certificate authorities may issue HTTPS certificates for it. If someone tries to get a certificate for your domain from any other authority, it should refuse.

It is a small extra protection rather than an urgent fix, which is why our check gives a warning, not a fail, when it is missing.

In our November 2026 study of businesses selling to AI agents, 82% of the 1,190 websites we checked had no CAA record. See the full study.

Why it matters

Without a CAA record, any certificate authority may issue a certificate for your domain. A CAA record narrows that to the one or two you actually use, which makes a fraudulent certificate harder to obtain.

What our check looks for

• Pass: CAA record present
• Warning: No CAA record

Check ID dns.caa.present · Domain and email · Low priority

How to fix it

Typical records for cPanel hosting (AutoSSL)

example.co.uk.  CAA  0 issue "letsencrypt.org"
example.co.uk.  CAA  0 issue "sectigo.com"
example.co.uk.  CAA  0 iodef "mailto:you@example.co.uk"

cPanel AutoSSL uses Let's Encrypt or Sectigo, depending on your host. Ask your host which one if you are not sure, and list it.

Adding it in cPanel

cPanel > Zone Editor > Manage > Add Record > CAA

Choose type CAA, flag 0, tag "issue", and the authority's domain as the value. Add one record per authority.

Cloudflare

DNS > Records > Add record > CAA

Cloudflare adds the records for its own certificate authorities automatically once you create a CAA record, so its certificates keep renewing.

Common mistakes

• Listing an authority you do not use and leaving out the one you do, so the next certificate renewal fails.
• Typing the authority's name instead of its domain, such as "Lets Encrypt" instead of "letsencrypt.org".
• Forgetting subdomains that get certificates from a different provider, such as a shop or email service.

Related checks

• HSTS: make browsers always use the secure version of your site
• DMARC record: stop people sending fake email from your domain

Written by Derek Moore, who builds and runs websites for small UK businesses. Last checked 30 October 2026.