International·English INT · EN

The country sets the legal rules of the check, the language only the texts.

Check website

Permitted certificate authorities (CAA)

Does the domain define which authorities may issue security certificates for it?

Updated on 18 October 2026

What we check

We query the public DNS records of the domain for a CAA record. It names the certificate authorities, such as Let's Encrypt, Sectigo or DigiCert, that may issue certificates for the domain. If it is missing, we give a note. If it is present, we show the permitted authorities in the report.

Why it matters

A certificate proves to the browser that a website really belongs to this domain. It is issued by a certificate authority after it has checked that the applicant controls the domain.

Without a CAA record, any of the more than a hundred certificate authorities worldwide may issue a certificate for the domain. If an attacker manages to deceive one of them, for example with a forged proof, they obtain a valid certificate. With it they can run a deceptively genuine copy of the website with a padlock icon.

The CAA record restricts this to the authorities actually in use. All others are obliged to check the record and to refuse issuance. It is an additional safeguard, not a must.

How to fix it

  1. Find out the certificate authority. In the browser click the icon to the left of the address and open the details about the certificate. Under "Issued by" you find the authority, e.g. "Let's Encrypt" or "Sectigo".
  2. Create a CAA record. At the DNS provider create a record of type CAA on the domain:
example.ch.  CAA  0 issue "letsencrypt.org"

If you use several authorities, create a separate record for each. Optionally you can specify an address for reports:

example.ch.  CAA  0 iodef "mailto:it@example.ch"
  1. Adjust it when you change provider. If you move the website to another hosting provider or builder, check which certificate authority it uses and add it before the move.

Website builders

With Wix, Squarespace and similar services the provider issues the certificate. Ask the support which certificate authority they use before you set a CAA record.

How to check it yourself

Online tools such as "DNS Lookup" from mxtoolbox.com or dnschecker.org show the CAA records of a domain when you choose the type "CAA".

Frequently asked questions

Can a CAA record bring a website down?

Not immediately. It only takes effect when a new certificate is issued. If the authority of the hosting provider is missing there, the next renewal fails. So check the record after every change of provider.

How much does CAA count in the score?

Little, at most 5 of 100 points in the security area. It is an additional safeguard that many smaller websites do not have.

Check a website now

We check "Permitted certificate authorities (CAA)" and all other points in a few minutes, free and without sign-up.

Related topics