A CAA record marks an unknown tag as critical.

CAA_UNKNOWN_CRITICAL_TAG · Severity: Error

• ErrorCAA_UNKNOWN_CRITICAL_TAG

  A CAA record marks an unknown tag as critical.

  RFC 8659 says a certificate authority must not issue when the relevant CAA set has a critical property it does not understand. With this record in place, certificate requests for the domain are likely to be refused.

  Recommendation: Remove the critical flag (128) or the record, unless your certificate authority documents the tag.

Reported by

• CAA record check
• Domain health check

Available through the API

• CAA record check API
• Domain health check API

Related findings

• Warning CAA_INVALID_IODEF The CAA iodef target is not a mailto: or https: address.
• Warning CAA_INVALID_VALUE A CAA record value cannot be parsed.
• Info CAA_NOT_FOUND The domain has no CAA records.
• Info CAA_NO_ISSUANCE CAA forbids certificate issuance for the domain.

All findings