(CLOSED: Now documented) Does maradns support CAA requests?

[DieselDriver]

Hello,

does maradns support CAA requests?
domain. 3600 IN CAA 0 issue "letsencrypt.org"

Thanks.

[DieselDriver]

maradns is misbehaving. maradns should not supposed to answer ”SERVFAIL" if letsencrypt asks for CAA records and I don't have any CAA records.

[samboy]

MaraDNS Supports CAA records via the RAW record type. Here is how Google's CAA records would look in a MaraDNS zone file:

google.com. +86399 raw 257 \x00\x05'issuepki.goog'
google.com. +86399 raw 257 \x00\x05'issuesymantec.com'

And how they look when queried with dig:

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> @8.8.8.8 google.com caa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31258
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      CAA

;; ANSWER SECTION:
google.com.             86249   IN      CAA     0 issue "pki.goog"
google.com.             86249   IN      CAA     0 issue "symantec.com"

Here’s an example with letsencrypt:

example.com.            RAW 257 \x00\x05'issueletsencrypt.org' ~

Which looks like this with Dig:

example.com.         86399   IN      CAA     0 issue "letsencrypt.org"

More discussion:

https://web.archive.org/web/20201029102445/https://github.com/samboy/MaraDNS/issues/35

[DieselDriver]

Thanks, a lot. In your documentation I could not find this information.

[samboy]

I plan to update the documentation to address this. This is a very common question and has been asked at least twice before.

[samboy]

Done: 070db6c and bd513bb

[samboy]

Locking discussion to stop spam bots.