caa.syntax Reviewed July 2026

Quick fix

Remove malformed or duplicate CAA fragments.

What this finding means

CAA records authorize certificate authorities to issue certificates for a domain. SecuTest validates flags, tags, values, and inherited policy structure without claiming that CAA replaces certificate monitoring.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact Malformed CAA records may be ignored or cause certificate issuance behavior that differs from the intended policy.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for CAA policy.
  • The certificate automation, ACME account, CDN, load balancer, or reverse proxy that requests certificates.

Remediation procedure

  1. Remove malformed or duplicate CAA fragments.
  2. Use supported tags such as issue, issuewild, and iodef.
  3. Publish CA identifiers exactly as documented by the chosen authority.
  4. Coordinate the change with automated certificate issuance workflows.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect CAA
dig +short CAA example.com

Inspect the served certificate
openssl s_client -connect example.com:443 -servername example.com </dev/null

Verify the fix

  1. Run: dig +short CAA example.com
  2. Confirm each record has valid flags, tag, and quoted value.
  3. Perform a controlled certificate renewal before the current certificate expires.
  4. Repeat the SecuTest scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Blocking the CA used by production automation.
  • Assuming CAA revokes existing certificates.
  • Forgetting inherited parent policy.

Authoritative references