What it is
CAA records list the certificate authorities allowed to issue TLS certificates for a domain, and every public CA must check them before issuing. The CA starts at the hostname and works up through its parent domains, using the first set it finds, so CAA on example.com also covers www.example.com. The records can also name an address where CAs report requests that break the policy.
Why it matters
Without CAA, any publicly trusted CA will issue a certificate for the domain, so an attacker only needs to fool whichever one has the weakest checks. With it, the rest refuse. The allowed list also shows which CAs the organisation gets its certificates from.
How this assessment works
Skopeon Labs queries public infrastructure signals and authoritative network protocols directly from external sensor nodes. All evaluations are completely non-invasive and agentless, assessing observable configurations without sending malicious payloads or disrupting service.
Operational Scope & Limitations
This check evaluates public perimeter responses observable at the time of inquiry. Endpoints protected behind third-party reverse proxies or CDNs reflect the edge configuration of the proxy layer.