caa.syntax Reviewed July 2026

Quick fix

Remove malformed or duplicate CAA fragments.

What this finding means

CAA records identify certificate authorities authorized to issue for a domain. SecuTest validates flags, tags, values, and inherited policy structure. CAA is preventive policy, not a replacement for certificate-transparency monitoring.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type Unauthorized certificate issuance due to policy failure

How the attack or failure scenario works

If a CAA policy is malformed, a certificate authority may treat it as absent or return an error according to its validation logic. An attacker still needs to satisfy the CA's domain-control validation or compromise an issuance workflow; malformed CAA alone does not grant a certificate.

Conditions and limitations

  • A malformed CAA value is published.
  • A certificate authority encounters the defective policy during issuance.
  • An attacker or compromised account can also pass the CA's domain validation.

Why it matters

Security and business impact Malformed CAA records may be ignored or produce issuance behavior different from the intended certificate-authority policy.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for CAA policy.
  • The certificate automation, ACME account, CDN, load balancer, or reverse proxy requesting certificates.

Remediation procedure

  1. Remove malformed or duplicate CAA fragments.
  2. Use supported tags such as `issue`, `issuewild`, and `iodef`.
  3. Publish CA identifiers exactly as documented by each required authority.
  4. Test automated certificate renewal before the current certificate expires.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Let's Encrypt example
example.com. 3600 IN CAA 0 issue "letsencrypt.org"

Wildcard restriction
example.com. 3600 IN CAA 0 issuewild ";"

Inspect CAA
dig +short CAA example.com

Verify the fix

  1. Run `dig +short CAA example.com`.
  2. Confirm each record contains valid flags, tag, and quoted value.
  3. Test normal and wildcard renewal paths in a controlled window.
  4. Review CA and ACME logs for policy errors.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Blocking the CA used by production automation.
  • Using the wrong CA identifier from a marketing name rather than provider documentation.
  • Assuming CAA revokes certificates that already exist.

Authoritative references