DNS: leave CAA off by default #294

Merged

jcoffey-dev merged 1 commits from fix/caa-default-292 into main

2026-11-05 05:54:42 +00:00

Author	SHA1	Message	Date
jcoffey-dev	cc282697e8	DNS: leave CAA off by default github/ci (branch) GitHub Actions Details ci / fork-checks (pull_request) Skipped Details ci / build (pull_request) Skipped Details ci / github (pull_request) Successful in 4s Details A CAA record with accounturi covers every name under the domain, so another ACME client there, like certbot on a web server, is refused at its next renewal. Nothing warned about it and it could be weeks before it showed. New domains now have to ask for CAA. The field description says why, and domains that already publish it keep it. The DNS-PERSIST-01 validation record was only built as part of CAA, so without this a persist provider on a domain not publishing CAA could never validate. It's now published either way for those providers. Fixes #292	2026-11-04 21:32:01 -07:00

Author

SHA1

Message

Date

jcoffey-dev

cc282697e8

DNS: leave CAA off by default

github/ci (branch) GitHub Actions

Details

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

ci / github (pull_request) Successful in 4s

Details

A CAA record with accounturi covers every name under the domain, so another
ACME client there, like certbot on a web server, is refused at its next
renewal. Nothing warned about it and it could be weeks before it showed.
New domains now have to ask for CAA. The field description says why, and
domains that already publish it keep it.

The DNS-PERSIST-01 validation record was only built as part of CAA, so
without this a persist provider on a domain not publishing CAA could never
validate. It's now published either way for those providers.

Fixes #292

2026-11-04 21:32:01 -07:00