Hurricane Electric's IPv6 Tunnel Broker Forums

Please login or register.

Login with username, password and session length
Advanced search  

News:

Welcome to Hurricane Electric's Tunnelbroker.net forums!

Author Topic: CAA records  (Read 2298 times)

maleks

  • Newbie
  • *
  • Posts: 1
    • View Profile
CAA records
« on: December 22, 2015, 03:56:12 PM »

Hello HE!

I would like to see support for adding CAA records if that is possible:
DNS Certification Authority Authorization (CAA) uses the Internet's Domain Name System to specify which Certificate Authorities may be regarded as authoritative for a domain. This is intended to support additional cross-checking at the client end of TLS connections to attempt to prevent certificates issued by CAs other than the specified CAs from being used to spoof the identity of websites or perform man-in-the-middle attacks on them.

https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization

Thanks ;)
Logged

chaz6

  • Newbie
  • *
  • Posts: 10
    • View Profile
Re: CAA records
« Reply #1 on: December 31, 2015, 07:45:16 AM »

I support this change.
Logged

passport123

  • Newbie
  • *
  • Posts: 32
    • View Profile
Re: CAA records
« Reply #2 on: December 31, 2015, 12:17:21 PM »


I like this cross-check concept.  I am already doing a similar thing for two of my domains using TLSA records.
Logged

notzac

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: CAA records
« Reply #3 on: January 06, 2016, 10:40:56 PM »

I'd love to be able to set CAA records for my domains as well!
Logged

kcochran

  • Sr. Network Engineer, Hurricane Electric
  • Administrator
  • Sr. Member
  • *****
  • Posts: 398
    • View Profile
Re: CAA records
« Reply #4 on: January 07, 2016, 07:34:54 AM »

Not currently supported by the backend, and their roadmap doesn't have it as a high priority.

CAA records, while noted as a possible cross-check on wikipedia, seem to not be headed that way based on the feature requests for FF and Chrome.  The use case for CAA records seems to have focused on CAs being the consumer of the record prior to cert issuance (and mandating use of them when available as part of the requirements to remain in the root cert store on those browsers), and then any DNS-based cert verification on the client-side would be handled by DANE.
Logged

HQuest

  • Newbie
  • *
  • Posts: 10
    • View Profile
Re: CAA records
« Reply #5 on: June 26, 2016, 04:35:57 PM »

Well, we now have BIND and NSD supporting CAA. And Let's Encrypt is getting some pace...
Logged

HQuest

  • Newbie
  • *
  • Posts: 10
    • View Profile
Re: CAA records
« Reply #6 on: March 22, 2017, 07:21:02 PM »

A few months have passed, many places are relying/verifying DANE entries, and is its still out of scope for the HE DNS servers?

Sorry to "resurrect" a topic - making a new one for this year old question would have the a lesser effect. After all, this one has, uh, history.
Logged

PepperdotNet

  • Newbie
  • *
  • Posts: 4
    • View Profile
Re: CAA records
« Reply #7 on: April 04, 2017, 12:37:43 PM »

Add 1 to the vote total for implementing this, please.
Logged

snarked

  • Hero Member
  • *****
  • Posts: 688
    • View Profile
Re: CAA records
« Reply #8 on: April 04, 2017, 01:41:52 PM »

Vote yes +1.

I have already added these records to my DNS zones, of which HE's DNS servers are secondary servers for the zones.
Logged

universite

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: CAA records
« Reply #9 on: April 18, 2017, 09:36:17 PM »

Vote yes +
Logged

lasaine

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: CAA records
« Reply #10 on: April 19, 2017, 02:47:15 AM »

Having a valid CAA record becomes mandatory in order to get a TLS certificate:
https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/

So I'd say it's time to reconsider the priority of adding this feature.
Logged

royce

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: CAA records
« Reply #11 on: April 28, 2017, 08:02:00 AM »

@kcochran, given the CA/B forum vote that @lasaine already cited, I'm working on a list of the status of provider CAA support here:

https://gist.github.com/roycewilliams/1710ade469c05eb0b090d268470aa741

Can you tell us whether there is an explicit feature request / RFE for CAA record support, and/or if there is an updated ETA from your post in January 2016?

[ Edit: fixed typo in handle for kcochran / @kcochran ]
Logged

Gary P

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: CAA records
« Reply #12 on: May 05, 2017, 09:20:38 AM »

After some digging it seems that the DNS server software he.net use has been updated to support CAA records, but it requires them to do a major version upgrade, so it is likely non-trivial.

I also have CAA records in my DNS zones that he.net secondary and would appreciate it if they update to a version of the server software that supports the record type.
Logged

artturnip

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: CAA records
« Reply #13 on: May 18, 2017, 12:00:29 PM »

I would also love to see support for DNS CAA records using Hurrican Electric DNS!
Logged