No CAA record

Without a CAA record, any of the world's hundred-plus certificate authorities may issue a certificate for your domain. A CAA record is one line in DNS that limits this to the authorities you actually use — all others must refuse.

The protection covers a rare but expensive case: someone tricks an arbitrary certificate authority into issuing a certificate for your domain and can then impersonate you. No acute damage — but a safeguard that costs nothing and takes five minutes.

Check it yourself: `dig CAA your-domain.com +short` — if nothing comes back, the record is missing. When adding it, name the authority your host actually renews through, otherwise the next renewal fails.