CAA records

[maleks]

Hello HE!

I would like to see support for adding CAA records if that is possible:
DNS Certification Authority Authorization (CAA) uses the Internet's Domain Name System to specify which Certificate Authorities may be regarded as authoritative for a domain. This is intended to support additional cross-checking at the client end of TLS connections to attempt to prevent certificates issued by CAs other than the specified CAs from being used to spoof the identity of websites or perform man-in-the-middle attacks on them.

https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization

Thanks ;)

[chaz6]

I support this change.

[passport123]

I like this cross-check concept.  I am already doing a similar thing for two of my domains using TLSA records.

[notzac]

I'd love to be able to set CAA records for my domains as well!

[kcochran]

Not currently supported by the backend, and their roadmap doesn't have it as a high priority.

CAA records, while noted as a possible cross-check on wikipedia, seem to not be headed that way based on the feature requests for FF and Chrome.  The use case for CAA records seems to have focused on CAs being the consumer of the record prior to cert issuance (and mandating use of them when available as part of the requirements to remain in the root cert store on those browsers), and then any DNS-based cert verification on the client-side would be handled by DANE.

[HQuest]

Well, we now have BIND and NSD supporting CAA. And Let's Encrypt is getting some pace...

[HQuest]

A few months have passed, many places are relying/verifying DANE entries, and is its still out of scope for the HE DNS servers?

Sorry to "resurrect" a topic - making a new one for this year old question would have the a lesser effect. After all, this one has, uh, history.

[PepperdotNet]

Add 1 to the vote total for implementing this, please.

[snarked]

Vote yes +1.

I have already added these records to my DNS zones, of which HE's DNS servers are secondary servers for the zones.

[universite]

Vote yes +

[lasaine]

Having a valid CAA record becomes mandatory in order to get a TLS certificate:
https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/

So I'd say it's time to reconsider the priority of adding this feature.

[royce]

@kcochran, given the CA/B forum vote that @lasaine already cited, I'm working on a list of the status of provider CAA support here:

https://gist.github.com/roycewilliams/1710ade469c05eb0b090d268470aa741

Can you tell us whether there is an explicit feature request / RFE for CAA record support, and/or if there is an updated ETA from your post in January 2016?

[ Edit: fixed typo in handle for kcochran / @kcochran ]

[Gary P]

After some digging it seems that the DNS server software he.net use has been updated to support CAA records, but it requires them to do a major version upgrade, so it is likely non-trivial.

I also have CAA records in my DNS zones that he.net secondary and would appreciate it if they update to a version of the server software that supports the record type.

[artturnip]

I would also love to see support for DNS CAA records using Hurrican Electric DNS!

[patrikx3]

Vote yes +