CAA is a DNS record that says which certificate authorities are allowed to issue certificates for your domain. It is one of the cheapest controls you can deploy: a few DNS records that stop an unrelated CA from being talked into issuing for your name.
SSLBoard shows the issuer values found for discovered names so you can check them for consistency across the domain. It is also the control that limits certificates you did not expect.
Reading the two columns
- The ordinary issuer column is your
issuerecords. - The wildcard issuer column is your
issuewildrecords.
Multiple entries in either column simply authorize multiple CAs.
None does not mean no. This is the misreading worth burning into memory:
| What you see | What it actually means |
|---|---|
| Wildcard column: None | No issuewild records exist, so wildcard issuance follows your issue policy |
| An explicitly empty issuer value | Issuance genuinely is prohibited. Different thing entirely |
| Section unavailable or no rows | The lookup did not produce usable data. Not a deliberate deny-all |
CAA also has inheritance and lookup rules that walk up the domain tree, so check the effective policy rather than one label in isolation. The CAA specification has the resolution rules.
What CAA does not do
- It does not revoke anything already issued.
- It does not prove an existing certificate complied with a policy that did not exist when it was issued.
- It does not guarantee your renewal automation will succeed. It can, in fact, break it.
That last one is the practical risk. Narrowing CAA is a change that fails quietly, at renewal time, weeks later.
Change it safely
- Inventory which CAs actually issue for you today, including the ones your managed hosting and renewal tooling use on your behalf. Free ACME providers behind a platform count.
- Publish a policy that includes all of them.
- Wait out the relevant TTLs.
- Run a fresh scan and read both columns for the affected names.
- Confirm a renewal actually completes before you narrow anything further.
CAA rows give you policy visibility and do not carry their own penalty in the TLS score.