Check ID: zone_record_caa_exists
Provider: Cloudflare
Service: zone
Severity: LOW
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for CAA (Certificate Authority Authorization) DNS records by checking if they exist with issue or issuewild tags that specify which certificate authorities are permitted to issue SSL/TLS certificates for the domain.

​
Risk

Without CAA records or issue/issuewild tags, any certificate authority can issue certificates for your domain. Unauthorized certificates enable man-in-the-middle attacks and domain impersonation. CAA records with only iodef tags do not restrict certificate issuance.

​
Recommendation

Add CAA records with issue or issuewild tags specifying authorized certificate authorities.
  • issue tag: authorizes CAs for regular (non-wildcard) certificates
  • issuewild tag: authorizes CAs for wildcard certificates specifically
  • Use issue ";" to block all certificate issuance (for domains that should never have certificates)
  • Use iodef tag to receive reports of policy violations (optional, for monitoring)
  • All CAs are required to check CAA records before issuing certificates

​
Remediation

# Create CAA record to restrict certificate issuance
resource "cloudflare_record" "caa_issue" {
  zone_id = "<ZONE_ID>"
  name    = "@"
  type    = "CAA"
  data {
    flags = "0"
    tag   = "issue"                # Restricts which CAs can issue regular certificates
    value = "letsencrypt.org"      # Specify your authorized certificate authority
  }
}

# Create CAA record to restrict wildcard certificate issuance
resource "cloudflare_record" "caa_issuewild" {
  zone_id = "<ZONE_ID>"
  name    = "@"
  type    = "CAA"
  data {
    flags = "0"
    tag   = "issuewild"            # Restricts which CAs can issue wildcard certificates
    value = "letsencrypt.org"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_record_caa_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks