Internet.nl adds CAA test and announces TLS test changes

News | June 2, 2025

As of today, Internet.nl makes it possible to test your domains for Certification Authority Authorization (CAA). The new CAA subtest is part of both the website and the mail test. Currently the subtest does not impact score.

What is CAA?

Certification Authority Authorisation (CAA) allows you as a domain name holder to specify one or more certification authorities authorised to issue certificates for your domain name. A certificate authority must not issue a certificate unless the certificate authority determines that the certificate request is consistent with the applicable CAA records.

Why is CAA important?

For the secure connection to your website or mail server, its certificate is crucial. If a malicious party is able to obtain a certificate for your domain name, it may be able to intercept sensitive data. By limiting the number of authorized certificate authorities, you reduce the risk of mis-issuance.

Note that CAA works differently than DANE. The objective of CAA record is to reduce the risk of certificate mis-issue. While DANE is a mechanism to check the validity of issued certificates and thus to prevent mis-issued certificates from being trusted. Especially for email, it is important to also apply DANE because it is the most widely used standard for authenticated mail transport encryption.

What does the CAA test in Internet.nl check for?

Internet.nl checks if the name servers of your tested domain or the domains of its mail servers (MX) contain one or more CAA records, that are all have correct syntax. At least one of these CAA records must have the issue tag. Otherwise, the test will result in a fail. It is not checked whether the certificate authority of the current TLS certificate matches one or more of the issue and issuewild values, i.e., whether the current certificate could be reissued at this time. Note that the result of the test currently does not weigh into the score.

If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters validationmethods and accounturi to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add issuewild, issuemail and issuevmc with an empty ; if you do not use wildcard, S/MIME and/or BIMI certificates respectively. This is especially important for issuemail and issuevmc, because in their absence there is no fallback to issue and thus any certificate authority can still issue S/MIME and/or BIMI certificates for your domain.

Upcoming release: new TLS guidelines

NCSC-NL recently published a new version of its TLS guidelines (in Dutch). The upcoming release of Internet.nl will use these updated guidelines as the baseline for the TLS test. We expect this new version of Internet.nl to go live around September/October 2025.

About Internet.nl

The test tool Internet.nl is an initiative of the Dutch Internet Standards Platform which is a collaboration of partners from the Internet community and the Dutch government. The aim of the platform is to jointly increase the use of modern Internet standards to make the Internet more accessible, safer and more reliable for everyone. The software code of Internet.nl is available under an open source license.

Release notes 1.10.0

Feature changes

  • A test for CAA records was added for web and mail tests. This checks for the presence of one or more correctly formatted CAA records, of which one must have an issue tag. This test is not required, i.e. does not affect scoring.
  • The sectxt library, used for validating security.txt files, was updated from 0.9.4 to 0.9.7. This includes:
  • A new error if a PGP signed message ends with more than one newline, named too_many_line_separators (sectxt/#78).
  • Improved detection of repeated use of fields that must only occur once. Previously, these were not always detected (sectxt/#83).
  • Fixed an issue with checking signatures made with AEAD keys (sectxt/#79).
  • Fixed exception for certain malformed PGP signatures.
  • The test date and time are now included in the print CSS.

Significant internal changes

Possibly required changes to deployments

  • The resolver-permissive container was obsoleted and removed.
  • Periodic tests will only run when specifically enabled with the CRON_15MIN_RUN_TESTS, TEST_DOMAINS_SITE and/or TEST_DOMAINS_MAIL settings.
  • There is now support for running multiple instances per server, sharing a Routinator instance, intended for acceptance testing.

On upgrade from an earlier version, a change in networking setup requires recreation of one of the Docker networks. Before deploy, bring down the entire environment and make sure the network is removed: docker compose --project-name=internetnl-prod down docker network rm internetnl-prod_public-internet

API changes

  • The API version was updated to version 2.5.0.
  • The fields caa_enabled, caa_errors, caa_recommendations, caa_records, and caa_found_on_domain have been added (OpenAPI diff).
  • The API report URL was updated to use HTTPS.

Other news

Read more articles

Frequently asked questions

How can I improve the score of a test?

In the test results, you will find an explanation of our findings for all the (sub)tests. Based on this, you could (let someone) make changes to your web or mailserver or connection.

Additional information can be found in our Knowledge base or our Toolbox Wiki.

Why do other test tools show different results?

Internet.nl attempts to always test against the most recent norms and standards. Additionally, we test as thoroughly as we can realise. This is why our results can differ from other (commonly-used) testing tools.

Some of the norms used in Internet.nl are set by the Dutch government. These can be implemented world-wide (and we recommend it!), but be aware that local regulations may differ from the norms used in Internet.nl.

How can I keep up to date of new developments?

News about Internet.nl is always shared on our website and social media. New versions are announced in a news post with the most important changes. You can also follow our work on the source code, new ideas and contributions are very welcome as well!

Users of our API and dashboard are automatically signed up to a mailing list in which we share updates and organise virtual meetings.

How can I (regularly) test multiple domain names?

This is supported by our dashboard and API. You can request an account here if your organisation fits in the target audience. The dashboard is also open source, so you could host this yourself as well.

In the dashboard, it is possible to enter lists of domain names, which then can be automatically tested on a specified interval. You can opt-in to receive an e-mail for every test result.

Can I join the Dutch Internet Standards Platform?

Where our Platform is focused on Dutch organisations, we are facilitating the Global Internet Standards Testing Community (GISTC) to connect international users of the test tool. You can register yourself for the community via international@internet.nl.

Find more answers