No CAA record
sec_caa_missingShort answer
Add CAA records that name the certificate authorities you actually use, for example 0 issue "letsencrypt.org". Public CAs must check these records before issuing, so a CA you have not listed will refuse a certificate for your domain.
Why it matters
Any of the many publicly trusted CAs can issue a certificate for your domain if someone convinces it that they control the domain, for example through a hijacked DNS account, a compromised hosting account that can answer HTTP validation, or a weak validation process at one CA. With a valid certificate an attacker can impersonate your site without a browser warning. CAA reduces that set to the CAs you name.
It is a defence-in-depth measure, which is why the severity is low. It has no search ranking effect.
How Glimana detects it
Glimana looks up CAA records first on the site's host name and then on the registrable domain, the way CAs walk up the DNS tree. If neither has a CAA record, the problem is reported as low. Any CAA record makes the check pass; Glimana does not check whether the CA that issued your current certificate is listed. If DNS could not be queried, the result is Could not be measured.
How to fix it
Watch out
CAA applies to every certificate for the domain and all its subdomains. If you list only letsencrypt.org but your CDN, mail provider or a landing-page tool gets certificates from another CA, their next renewal fails and those hosts show certificate errors when the old certificate expires. Cloudflare issues edge certificates through Google Trust Services (pki.goog), Let's Encrypt, SSL.com and Sectigo; list every CA in use before you publish.
- Find the finding in Glimana. Open Security; this check is in the E-mail and DNS group, with the evidence from the last scan under its title. The same problem is listed under Issues › No CAA record.
-
Apply the fix on your platform.
In DNS › Records click Add record, Type
CAA, Name@, Flags0, Tag Only allow specific hostnames, CA domain name e.g.letsencrypt.orgfor your origin certificate. With Universal SSL, Cloudflare automatically adds hidden records for its own CAs as soon as any CAA record exists, so its edge certificates keep renewing; with Advanced Certificate Manager it does not, so add those CAs yourself.Add one CAA record per CA. In zone-file form:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"example.com. 3600 IN CAA 0 issuewild "letsencrypt.org"example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"
Common identifiers:
letsencrypt.org,pki.goog,sectigo.com,digicert.com,ssl.com,amazon.com(AWS Certificate Manager). If your panel has no CAA type, ask the provider. Check withdig +short CAA example.com. - Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.
How the fix is verified
After changing DNS, wait until the old record's TTL has passed, then press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.