CAA records: who may issue your certificates?
CAA is a DNS allow-list for certificate authorities. Without it, any CA can issue a cert for your name if they validate somehow.
US search interest: “caa record” ~720/mo (DataForSEO expansion brief).
What CrowWake checks
We resolve CAA at the apex. Missing CAA is a warn (common on small sites). Present records are summarized.
Why it matters
Mis-issued certificates are rare but painful. CAA is a cheap control that many agencies forget after a CDN migration.
If CrowWake crows
Publish CAA for your real CA (Let’s Encrypt, DigiCert, etc.) including accounturi/validationmethods if your provider documents them.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.