CAA record builder
Pick the CAs you trust. We emit the CAA records to publish at your domain's apex.
Configuration
Publish at the apex (no subdomain). Subdomains inherit unless they have their own CAA records.
CAs may post failure reports here when someone tries to get a cert they're not authorized to issue.
DNS records to publish
2 recordsexample.com CAA 0 issue "letsencrypt.org" example.com CAA 0 issuewild ";"
Why CAA? Without it, ANY publicly-trusted CA can issue a cert for your domain to anyone who passes their (sometimes weak) validation. A CAA record narrows the allowed set to the CAs you actually use, and an iodef= reporting URL gets you notified when an unauthorized CA tries.
Keep hardening your site
This is one check of many. Run the rest — every tool is free, no account.
Security headers scan
Grade your live response headers
TLS certificate scan
Grade chain, expiry, and key strength
Security headers builder
Emit a ready-to-paste header block
CSP analyzer
Grade your Content-Security-Policy
Cookie security audit
Check Secure, HttpOnly, SameSite
Mixed-content scanner
Find http:// assets on https pages
Open-redirect detector
Probe redirect params for abuse
HSTS preload checker
Grade against Chrome's preload list