docs: record CAA and DNSSEC on both domains #392

Merged

mysticalsoap merged 1 commit from docs/caa-dnssec into trunk

2026-10-07 21:33:39 -04:00

mysticalsoap commented

2026-10-07 21:32:08 -04:00

Owner

Problem

mysticalsoap.com and esotericsuds.com now carry CAA records and Porkbun DNSSEC (#127), both set at the registrar. Nothing in the repo said so, and the two constraints they add (no other CA or challenge type without widening CAA, DS record out before any nameserver move) were undocumented. Networking.md also only named one of the two domains Traefik issues certs for.

Fix

Networking.md § DNS and TLS: both domains, both cert shapes, the CAA/DNSSEC constraints and the diagnostic for a CAA renewal failure.
setup/Infrastructure.md § 6: the registrar step with the record values and the verify commands.

Closes #127.

Verification

Docs only, nothing live. Records and chain verified 2026-10-07: CAA answers from Porkbun's authoritative servers and 1.1.1.1 on both domains; delv reports ; fully validated for both via 8.8.8.8 and 1.1.1.1. Details on #127.

🤖 Generated with Claude Code

## Problem `mysticalsoap.com` and `esotericsuds.com` now carry CAA records and Porkbun DNSSEC (#127), both set at the registrar. Nothing in the repo said so, and the two constraints they add (no other CA or challenge type without widening CAA, DS record out before any nameserver move) were undocumented. `Networking.md` also only named one of the two domains Traefik issues certs for. ## Fix - `Networking.md` § DNS and TLS: both domains, both cert shapes, the CAA/DNSSEC constraints and the diagnostic for a CAA renewal failure. - `setup/Infrastructure.md` § 6: the registrar step with the record values and the verify commands. Closes #127. ## Verification Docs only, nothing live. Records and chain verified 2026-10-07: CAA answers from Porkbun's authoritative servers and 1.1.1.1 on both domains; `delv` reports `; fully validated` for both via 8.8.8.8 and 1.1.1.1. Details on #127. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mysticalsoap added 1 commit

2026-10-07 21:32:08 -04:00

docs: record CAA and DNSSEC on both domains

validate / validate (pull_request) Successful in 24s

Details

3c59f1f320

The CAA records pin issuance to Let's Encrypt over DNS-01, so a
second CA or an HTTP-01 resolver fails until the record is widened,
and the DS record has to go before any nameserver move or validating
resolvers SERVFAIL the domain. Neither constraint is visible from the
repo, since both live at the registrar.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mysticalsoap merged commit 545fa165c4 into trunk

2026-10-07 21:33:39 -04:00

mysticalsoap deleted branch docs/caa-dnssec

2026-10-07 21:33:39 -04:00

mysticalsoap referenced this pull request from a commit

2026-10-07 21:33:41 -04:00

Merge pull request 'docs: record CAA and DNSSEC on both domains' (#392) from docs/caa-dnssec into trunk