A CAA record restricts which certificate authorities may issue TLS certificates for your domain. Without one, any CA can — a risk if a CA is compromised or tricked. This tool reads and explains your CAA record.