Defaults.Exposed › October 2026 census › v10 registry › CAA records
CAA records
Methodology v10 · canonical ID caa-record · DNS (Domain Name System) Security · scored
Stops anyone but your chosen provider issuing SSL (Secure Sockets Layer) certificates for your domain.
CAA records: definition
| Canonical ID | caa-record |
|---|---|
| Category | DNS Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The domain publishes at least one CAA (Certification Authority Authorization) record restricting certificate issuance. |
| Fail | No CAA records are published (any CA may issue). |
| Example (passing) | example.com. IN CAA 0 issue "letsencrypt.org" |
CAA records across the census
1.42% of domains where the CAA lookup returned a determinate answer publish a CAA record (4,655,247 of 328,504,222, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
CAA records is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 3,988,097 of the 332,492,319 graded domains had no determinable result for this check: the CAA lookup has to return a determinate answer; lookups that time out or fail return N/A.
Every outcome in the census
| Outcome | Domains | Share of domains where the CAA lookup returned a determinate answer | In the headline figure |
|---|---|---|---|
| At least one CAA record | 4,655,247 | 1.42% | Yes |
| No CAA record (any CA may issue) | 323,848,975 | 98.6% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of domains where the CAA lookup returned a determinate answer that publish a CAA record by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 233,022,700 domains | 1.18% | .dev 6.84%, .fun 6.05%, .app 5.24% | .bond 0.03%, .garden 0.14%, .sbs 0.14% |
| Country-code TLDs (ccTLDs): 167 TLDs, 94,823,483 domains | 1.99% | .pl 6.58%, .ar 4.71%, .br 4.50% | .cn 0.12%, .cc 0.29%, .jp 0.67% |
The largest TLD in this base, .com, stands at 1.15% (1,763,101 of 153,135,531).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 327,846,183 of the 328,504,222 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 4 DNS Security checks with a published figure, CAA records has the 4th highest pass share. Next above it is DNSSEC (Domain Name System Security Extensions): 7.03% of graded domains. Across every check with a published figure it ranks 24th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix CAA records
CAA setup walkthroughs for 2 providers: AWS Route 53, Cloudflare. All of them are on the CAA setup walkthroughs by provider page.
Cite this check
Defaults.Exposed, "CAA records (caa-record)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/caa-record
Permalink: https://defaults.exposed/methodology/caa-record ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data