CAA validation check

Zone contains CAA records.

Integrity.

All nameserver IP addresses.

Every 5 minutes.

None.

Medium.

Purpose

The CAA records (Certificate Authority Authorisation) control which type of certificates can be issued and from which certification authority.

The CAA was introduced by the IETF in 2010 in response to growing concerns about the security of publicly trusted CA’s. It introduces a security policy mechanism to indicate to CAs whether they are allowed to issue digital certificates for a particular domain name.

The CAA validation check verifies that the CAA records remain unchanged by comparing the result of the check with the CAA records recorded when the check was set up.

Event severities and messages

The response matches with the expected values.
The CAA records remain unchanged.

No CAA records found even though they should.
It appears that the CAA records have been removed from the zone. If this is correct, please do a Reconfigure in the domain panel to let the monitoring system know there are no CAA records to check.

Unrecognised records.
Lists records that were received in the query response but don’t exist in configuration database.

Missing records.
Lists records that should have been included in the query response but weren’t.

Received RCODE from server.
Please see the Generic DNS response code page for further information.

Solutions, tips & tricks