Quick fix
Remove malformed or duplicate CAA fragments.
What this finding means
CAA records authorize certificate authorities to issue certificates for a domain. SecuTest validates flags, tags, values, and inherited policy structure without claiming that CAA replaces certificate monitoring.
Interpretation boundary
Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.
Why it matters
Security impact
Malformed CAA records may be ignored or cause certificate issuance behavior that differs from the intended policy.
Step-by-step fix
Where to make the change
- The authoritative DNS zone for CAA policy.
- The certificate automation, ACME account, CDN, load balancer, or reverse proxy that requests certificates.
Remediation procedure
- Remove malformed or duplicate CAA fragments.
- Use supported tags such as issue, issuewild, and iodef.
- Publish CA identifiers exactly as documented by the chosen authority.
- Coordinate the change with automated certificate issuance workflows.
Commands and configuration examples
Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.
dig +short CAA example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null
Verify the fix
- Run: dig +short CAA example.com
- Confirm each record has valid flags, tag, and quoted value.
- Perform a controlled certificate renewal before the current certificate expires.
- Repeat the SecuTest scan.
Confirm the externally visible result
Re-scan your domain
After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.
Common mistakes
- Blocking the CA used by production automation.
- Assuming CAA revokes existing certificates.
- Forgetting inherited parent policy.