How this check works
This check queries your domain's DNS and registration, climbing the domain chain (from app.yourdomain.com to yourdomain.com) because this data lives on the registrable domain. It looks at three things. CAA: if there are no CAA records at any level, low severity. DNSSEC: it asks for DS records over DNS-over-HTTPS; if there are none at any level, low severity. Expiry: it looks up the expiration date through RDAP, the successor to whois; 7 days or fewer left, high; 30 or fewer, medium; 60 or fewer, low. If the registry does not publish the date or a query fails, there is no finding: when in doubt, nothing is invented.
Why it matters
All three protect the domain itself, which sits underneath everything else. Without CAA, any of the world's hundred-plus certificate authorities can issue a valid certificate for your domain; with CAA only the ones you authorise can, which turns a fraudulent issuance into something detectable. Without DNSSEC, your domain's DNS answers are unsigned and an attacker who poisons a resolver's cache can send your users to another server with nothing giving it away. And expiry is the dumbest and most final risk: a domain that expires goes down entirely (web, email, API) and, after the grace period, someone else can register it. It happens to large companies every year because of an expired card.
How to fix it
CAA
yourdomain.com. CAA 0 issue "letsencrypt.org"
yourdomain.com. CAA 0 issuewild ";"
yourdomain.com. CAA 0 iodef "mailto:security@yourdomain.com"Authorise the authority that issues your certificates. If you use Vercel or Netlify, it is Let's Encrypt; if you use Cloudflare, check its documentation for the list of authorities it uses and add them all; if you buy certificates, your provider's. A CAA that does not include your real authority makes the next renewal fail silently, so check the first renewal after adding it. issuewild ";" forbids wildcards if you do not use them, and iodef says where to report attempted unauthorised issuance.
DNSSEC
It is enabled in two places. First at the DNS provider (Cloudflare, Route 53, the registrar itself): usually a button that signs the zone and shows you a DS record. Then that DS is published at the domain's registrar, which passes it to the TLD registry. If DNS and registration are in the same place, it is a single click. One warning: if you ever change DNS provider, remove the DS before moving the zone or the domain will stop resolving.
Expiry
Turn on auto-renew at the registrar, make sure the card on file does not expire before the domain, and keep the contact email valid, which is where the notices go. If the domain is your business's, renew for several years and enable transfer lock. Scanaris emails you 30, 14 and 3 days before it expires, just as with certificates.
Check it is fixed
dig +short CAA yourdomain.com
dig +short DS yourdomain.com
curl -s https://rdap.org/domain/yourdomain.com | grep -oE '"eventAction":"expiration","eventDate":"[^"]+"'Expected: at least one issue line in the first, one or more lines in the second, and a distant expiration date in the third. DNS changes take minutes to hours; the DS can take up to a day to appear at the TLD.
Frequently asked questions
Can DNSSEC break my site?
Only if misconfigured: a DS that does not match the zone's keys makes validating resolvers reject your domain. That is why it is best to enable it at a provider that manages the keys for you and to confirm with the command above and an external validator that everything lines up before calling it done.
My domain expires in a year. Why does nothing show?
Because it is fine. The finding only appears at 60 days or fewer. If you want peace of mind, turn on auto-renew now, while it is not urgent.
Does CAA replace having a good certificate?
No, they are different things. CAA limits who may issue; the quality of the certificate and protocol you have is measured by TLS certificate. And the same domain's email configuration is reviewed by email authentication.