CAA is a DNS policy that lets a domain restrict which certificate authorities may issue certificates for it. SSLBoard displays the issuer values associated with discovered names so you can review consistency across the domain.
Reading the policy rows
The ordinary issuer column represents issue records. The wildcard issuer column represents issuewild records. Multiple entries can authorize more than one issuer.
A displayed None means that the corresponding list has no values in the returned policy data. It does not automatically mean issuance is prohibited. In particular, when no issuewild policy exists, wildcard issuance follows the applicable issue policy. An explicit empty issuer value has different semantics from no restriction. CAA also has inheritance and lookup rules, so inspect the effective policy rather than only one DNS label. CAA specification
What this check does not prove
CAA is an issuance control. A current record does not prove that an older certificate violated the policy in force when it was issued. It also does not revoke certificates already issued or guarantee that your renewal configuration will succeed.
If the section is unavailable or contains no usable rows, do not infer a deliberate deny-all policy. Confirm the DNS lookup results and whether a policy is actually published.
Review and verify
Compare the effective policy with the certificate authorities your services use, including managed hosting and renewal systems. Before narrowing the list, confirm that legitimate issuance and renewal will still work.
After updating DNS, allow for the relevant TTLs, check the effective records, and run a fresh scan. Review the issuer and wildcard columns for affected names. CAA rows provide policy visibility; they do not currently contribute a separate penalty to the TLS score.