TWA 0604

TWA-0604

Message

"Domain doesn't specify any violation reporting endpoints"

Explanation

The twa script loads and parses the Certificate Authority Authorization (CAA) record from the Domain Name Server (DNS). A domain owner specifies in the CAA record which Certificate Authorities (CAs) are allowed to issue certificates containing the domain name.

Inside the CAA record an iodef property specifies a URL to which a certificate authority could report issues. An e-mail address could be given in the format mailto:_user@domain_.

Here the CAA record does not contain an iodef tag.

Remediation

Implement a process to handle security issues, e.g. an E-Mail address and persons which will read the messages and react.

Add the e-mail address to the CAA record. The CAA Record Helper could be used to generate a CAA record.

See

• CAA Record Helper
• Let's encrypt: Certificate Authority Authorization (CAA)
• RFC8659: DNS Certification Authority Authorization (CAA) Resource Record