Security tip 2 · Certificate Transparency

Get notified when someone issues a certificate for your domain.

Every certificate browsers trust is written to public logs. Let someone read them for you – and decide who may issue them in the first place. Free, and about 10 minutes with Cloudflare.

Last checked 1 November 2026

Go to the steps See it working on wi24rd.com
Time
~10 min
Price
Free on every Cloudflare plan
Two layers
CAA + CT the lock and the alarm
Needs
Access to your DNS

Why

The padlock can be faked – but not in secret.

The certificate is what gives the padlock in the browser. If an attacker gets a valid certificate issued for your domain – through a forgotten DNS record, a taken-over mailbox or a mistake at an issuer – a fake page can look completely real.

Since 2018, Chrome and Safari have required certificates to be written to public Certificate Transparency logs, or they will not trust them. So a certificate for your domain cannot be hidden. But someone has to look – and that is what CT monitoring does.

How it works: An issuer creates a certificate for your domain. It is written to a public Certificate Transparency log. The monitor reads the log and sends you an email.
  1. Issuercreates a certificate
  2. Public CT loganyone can read it
  3. Monitorspots your domain name
  4. Email to youyou check if it is yours

Two layers that work together

CAA records are the lock. A small DNS record telling every issuer who may create certificates for your domain. Everyone else must refuse.

CT monitoring is the alarm. It reads the public logs and writes to you when a certificate with your domain name appears.

Step by step · Cloudflare

Six steps, about 10 minutes.

  1. Open your domain in Cloudflare

    Log in to dash.cloudflare.com and choose the domain you want to protect.

  2. Go to Edge Certificates

    In the left menu: SSL/TLS → Edge Certificates. Scroll down to the Certificate Transparency Monitoring card.

  3. Switch monitoring on

    Flip the switch. A yellow notice appears: Alerts are on but no recipients are enrolled. It means nothing is sent to anyone yet.

  4. Add a recipient

    Enter your email under Notification email and press Add Email. When it says Alerts active – 1 recipients in green, it works.

  5. Add the lock: CAA records

    Go to DNS → Records → Add record. Choose the type CAA, the name @ (your domain), the tag Only allow specific hostnames (technically issue) and enter the issuer, e.g. letsencrypt.org. Save, and repeat with pki.goog (Google Trust Services).

  6. Check the result

    Run the command below. You will see more issuers than you entered: Cloudflare automatically adds – invisibly in the list – the issuers it uses for your certificates, so they can be renewed. That is expected. Every other issuer is now locked out.

dig ditdomaene.dk caa +short

On Windows: nslookup -type=CAA yourdomain.com. For wi24rd.com it shows five permitted issuers – instead of the hundreds that could otherwise have issued a certificate.

When the email arrives

Every email deserves a look.

Cloudflare filters out its own certificates – including the automatic renewals. So when an email arrives, it is a certificate someone else had issued. The email shows the domain, the issuer, the names on the certificate and how long it is valid.

  1. Did you order it yourself?

    Or a service you use: email provider, newsletter, web shop, hosting company. Then all is well.

  2. Do the names fit?

    Do you know every subdomain on the certificate? An unknown name can be a forgotten DNS record someone has taken over.

  3. Can nobody explain it?

    Contact the issuer – only they can revoke the certificate. Change the passwords for DNS and your domain registrar, and turn on two-factor authentication.

Without Cloudflare

It can be done too.

  • CAA can be set at most DNS providers – look for the CAA record type.
  • crt.sh is free and shows every certificate in the public logs. Search for %.yourdomain.com to see what already exists. It is a snapshot, not an alarm.
  • Cert Spotter monitors for you from 15 USD a month with a 30-day free trial. It also exists as a free open-source program you can run on your own server.

CT monitoring does not catch look-alike domains such as wi24rd-login.com – only certificates with your own domain name.

About this tip

wi24rd.com uses both layers itself. You can see the CAA records and DNSSEC looked up live under The seal. The steps were checked in Cloudflare’s dashboard on 1 November 2026, where Certificate Transparency monitoring is available on every plan.

Wi24rd has no financial interest in Cloudflare or SSLMate.

All security tips

Back to Security tipsTo the top

Missing a tip?

Write what you would like explained. The next security tip could be yours.

Write to Wi24rd The site’s own defences