Add a CAA record for the domain #127

New issue

Closed

opened 2026-08-17 17:49:57 -04:00 by mysticalsoap · 2 comments

mysticalsoap commented

2026-08-17 17:49:57 -04:00

Owner

No CAA record on the domain. One registrar-side record (0 issue "letsencrypt.org", plus issuewild same) means no other CA will issue for *.mysticalsoap.com even if DNS credentials or the registrar account are attacked through some other CA's validation. Five minutes at the registrar, no moving parts, nothing in this repo to change. Verify afterwards with dig CAA mysticalsoap.com.

While in the registrar panel: check whether DNSSEC is available for the domain and weigh enabling it (AdGuard upstream and split-horizon are unaffected either way).

No CAA record on the domain. One registrar-side record (`0 issue "letsencrypt.org"`, plus `issuewild` same) means no other CA will issue for `*.mysticalsoap.com` even if DNS credentials or the registrar account are attacked through some other CA's validation. Five minutes at the registrar, no moving parts, nothing in this repo to change. Verify afterwards with `dig CAA mysticalsoap.com`. While in the registrar panel: check whether DNSSEC is available for the domain and weigh enabling it (AdGuard upstream and split-horizon are unaffected either way).

mysticalsoap added the

general-admin

label

2026-08-17 17:49:57 -04:00

mysticalsoap referenced this issue

2026-08-17 17:50:17 -04:00

Stack analysis: feature gaps and divergence from other homelabs #116

mysticalsoap commented

2026-10-07 21:18:27 -04:00

Author

Owner

Checked before handing over (2026-10-07):

No CAA on either domain today. Both mysticalsoap.com and esotericsuds.com sit on Porkbun's nameservers and get Let's Encrypt certs from Traefik's porkbun resolver (DNS-01 only, no caServer override). esotericsuds.com needs the same records, which the issue didn't name.
Porkbun's API docs list CAA as a supported record type, and the KB has a one-click "Porkbun DNSSEC" toggle (Details → Porkbun DNSSEC) for domains on its own nameservers. Neither domain has a DS record yet.

Records to add on each domain, Host left blank (apex), default TTL:

CAA  0 issue "letsencrypt.org;validationmethods=dns-01"
CAA  0 issuewild "letsencrypt.org;validationmethods=dns-01"

validationmethods=dns-01 is safe here because DNS-01 is the only challenge the stack uses. accounturi pinning is skipped on purpose: a lost acme.json would mint a new account and silently break issuance until the record was edited.

DNSSEC caveat: once on, moving the domain to other nameservers requires removing the DS record first, or validating resolvers return SERVFAIL. Traefik's DNS-01 through the Porkbun API is unaffected.

Verify afterwards:

dig +short CAA mysticalsoap.com; dig +short CAA esotericsuds.com
dig +short DS mysticalsoap.com; dig +short DS esotericsuds.com
delv mysticalsoap.com A | head -1   # "; fully validated" once DNSSEC is live

Checked before handing over (2026-10-07): - No CAA on either domain today. Both `mysticalsoap.com` and `esotericsuds.com` sit on Porkbun's nameservers and get Let's Encrypt certs from Traefik's `porkbun` resolver (DNS-01 only, no `caServer` override). `esotericsuds.com` needs the same records, which the issue didn't name. - Porkbun's API docs list CAA as a supported record type, and the KB has a one-click "Porkbun DNSSEC" toggle (Details → Porkbun DNSSEC) for domains on its own nameservers. Neither domain has a DS record yet. Records to add on each domain, Host left blank (apex), default TTL: ``` CAA 0 issue "letsencrypt.org;validationmethods=dns-01" CAA 0 issuewild "letsencrypt.org;validationmethods=dns-01" ``` `validationmethods=dns-01` is safe here because DNS-01 is the only challenge the stack uses. `accounturi` pinning is skipped on purpose: a lost `acme.json` would mint a new account and silently break issuance until the record was edited. DNSSEC caveat: once on, moving the domain to other nameservers requires removing the DS record first, or validating resolvers return SERVFAIL. Traefik's DNS-01 through the Porkbun API is unaffected. Verify afterwards: ``` dig +short CAA mysticalsoap.com; dig +short CAA esotericsuds.com dig +short DS mysticalsoap.com; dig +short DS esotericsuds.com delv mysticalsoap.com A | head -1 # "; fully validated" once DNSSEC is live ```

mysticalsoap commented

2026-10-07 21:28:04 -04:00

Author

Owner

Verified 2026-10-07 after the registrar changes:

CAA on both domains, from Porkbun's authoritative servers and via 1.1.1.1:
0 issue "letsencrypt.org;validationmethods=dns-01" and 0 issuewild same.
DNSSEC: DS records present at the .com servers for both domains (algorithm 13, SHA-256 digest, key tag 2371 on each). delv reports ; fully validated for both via 8.8.8.8 and 1.1.1.1, and the AD flag is set. Quad9 still returned a cached unsigned answer for esotericsuds.com a few minutes after the toggle; that clears on its own as the negative cache expires.

Nothing changed in this repo. The next wildcard renewal is the live proof the CAA record doesn't block Traefik's DNS-01; Traefik logs will show it.

Verified 2026-10-07 after the registrar changes: - CAA on both domains, from Porkbun's authoritative servers and via 1.1.1.1: `0 issue "letsencrypt.org;validationmethods=dns-01"` and `0 issuewild` same. - DNSSEC: DS records present at the .com servers for both domains (algorithm 13, SHA-256 digest, key tag 2371 on each). `delv` reports `; fully validated` for both via 8.8.8.8 and 1.1.1.1, and the AD flag is set. Quad9 still returned a cached unsigned answer for `esotericsuds.com` a few minutes after the toggle; that clears on its own as the negative cache expires. Nothing changed in this repo. The next wildcard renewal is the live proof the CAA record doesn't block Traefik's DNS-01; Traefik logs will show it.

mysticalsoap referenced this issue from a pull request that will close it,

2026-10-07 21:32:08 -04:00

docs: record CAA and DNSSEC on both domains #392

mysticalsoap closed this issue

2026-10-07 21:33:39 -04:00