CAA record published by default breaks other ACME clients on the same domain #292

New Issue

Closed

opened 2026-11-05 04:06:14 +00:00 by jcoffey-dev · 0 comments

jcoffey-dev commented

2026-11-05 04:06:14 +00:00

Owner

A domain with automatic certificates and automatic DNS publishes CAA at its apex by default, with accounturi set to inbuxa's ACME account (crates/common/src/network/dns/records.rs, and caa is on in the publishRecords defaults). CAA also covers names below the domain, so another ACME client on a different account, like certbot on a web server, gets refused at its next renewal. Nothing warns you, and it can be weeks before it shows up.

This is from reading the code, not reproduced yet. We should at least warn about it in the docs and console, and maybe leave CAA off by default.

Came up on the forum: https://community.coffeylabs.org/t/210

A domain with automatic certificates and automatic DNS publishes CAA at its apex by default, with `accounturi` set to inbuxa's ACME account (`crates/common/src/network/dns/records.rs`, and `caa` is on in the `publishRecords` defaults). CAA also covers names below the domain, so another ACME client on a different account, like certbot on a web server, gets refused at its next renewal. Nothing warns you, and it can be weeks before it shows up. This is from reading the code, not reproduced yet. We should at least warn about it in the docs and console, and maybe leave CAA off by default. Came up on the forum: https://community.coffeylabs.org/t/210