infoSeverity: infoRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.DNS · CAAWhere it livesImplementationThis fix is applied in: DNS · CAA. That's the surface you'll edit, DNS, response headers, or a static file.~3 minTime to fixEffortRoughly 3 minutes of hands-on work, propagation aside. Most of these are copy-paste.+1 posture+1 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

CAA: control which CAs can issue certificates for you

Lock certificate issuance to your CA and no one else

The threat

Without a CAACAATLS / PKICertification Authority Authorization: a DNS record naming which certificate authorities may issue TLS certificates for your domain, blocking rogue or mistaken issuance. record, any public Certificate Authority will issue a TLS certificate for your domain to whoever can pass their validation. If an attacker ever tricks a CA (or a CA is compromised), they can mint a valid cert for your site and impersonate you with a green padlock. CAA (Certification Authority Authorization) tells the world’s CAs: only these are allowed to issue for me, everyone else, refuse.

The exact fix

Our site is served by Netlify, which uses Let’s Encrypt. Add three CAA records. If your DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. panel splits the record into Flag / Tag / Value fields, use the columns below; if it’s one box, the equivalent string is in the last column.

TypeNameFlagTagValueOne-line equivalent
CAA@0issueletsencrypt.org0 issue "letsencrypt.org"
CAA@0issuewildletsencrypt.org0 issuewild "letsencrypt.org"
CAA@0iodefmailto:security@yourdomain.com0 iodef "mailto:security@yourdomain.com"

issue covers normal certs, issuewild covers wildcards, and iodef is the address a CA emails if someone attempts an unauthorized issuance. TTL 3600.

If you ever switch CAs, add that CA to the issue/issuewild records too, otherwise renewals fail.

Verify it

dig +short CAA yourdomain.com

Expected:

0 issue "letsencrypt.org"
0 issuewild "letsencrypt.org"
0 iodef "mailto:security@yourdomain.com"

Proof

These three records were the −1 that tipped dev3lop.com over the line from B (89) to grade A (90), and set up the final move to a perfect 100.