Skip to content

Instantly share code, notes, and snippets.

@roycewilliams
Last active March 23, 2024 12:56
Show Gist options
  • Save roycewilliams/1710ade469c05eb0b090d268470aa741 to your computer and use it in GitHub Desktop.
Save roycewilliams/1710ade469c05eb0b090d268470aa741 to your computer and use it in GitHub Desktop.
CAA-adoption-notes.md

CAA Adoption Notes

CA/B mandate

The CA/Browser Forum has voted to mandate that CAs must start checking CAA records to control certificate issuance (to verify what CAs are allowed to issue certificates for a domain) by September 8th, 2017.

https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum

Full language of the ballot is here.

For domain holders, not using CAA records implicitly allows any registrar to issue certificates for your domain (as long as their registration requirements are met).

Support by CAs

See https://sslmate.com/labs/caa/ for latest status of which CAs support CAA records. That page also has an introduction to CAA records, and a CAA record generator.

Support by DNS servers and hosting providers

CAA supported

CAA support requested (vote!)

CAA not yet supported, but planned

CAA not supported, and apparently not planned

  • eNom

CAA not yet supported, status unknown

CAA support status unknown (can you help?)

  • Afilias
  • BuddyNS
  • CDNetworks (BIND?)
  • DNS Made Easy
  • No-IP
  • NS1
  • PointHQ
  • UltraDNS
  • Verisign
  • ZoneEdit

Domain support

RFC 3597 syntax

  • RFC 3597 syntax (to add raw support for a new RR type even if not natively supported):

example.com. TYPE257 \# 8 000569737375653B

  • One-liner to convert from RFC 3597 to human-readable format (credit: Gervase Markham here, works with all raw RFC3597 TYPExxx records)

dig +short -t TYPE257 google.com | perl -nE '@x = split(); say map(chr, map { hex } ($x[2] =~ m/../g ))'

  • One-liner to convert from plain text to RFC 3597 format (credit: Henri in this thread):

perl -e '$_=shift;s/(.|\n)/printf("%02lx", ord $1)/eg;' 'your-text'

  • Linux one-liner:

echo -n 'your text' | xxd -p

Other references

@AbhishekGhosh
Copy link

Dyn Managed DNS added support without announcement (I am user). One day I was Google searching and saw they have documentation on Help > Zones. I added that on my forked version with their help page's link.

@roycewilliams
Copy link
Author

@AbhishekGhosh Good catch - updated, thanks!

@Hello71
Copy link

Hello71 commented Jun 14, 2017

buddyns supports CAA:

$ dig alxu.ca caa @b.ns.buddyns.com +short
128 issue "letsencrypt.org"

@phizev
Copy link

phizev commented Jun 26, 2017

@roycewilliams Thank you for doing this.
ClouDNS have added CAA support as per their announcement, they also have it covered in their documentation.
As an addendum, I just checked my Digital Ocean control panel, and the CAA record type is not listed, please see image below:
cloudns-dns-record-types

@roycewilliams
Copy link
Author

@Hello71, @phizev, @AGWA - thanks, updated!

@C4llumD
Copy link

C4llumD commented Aug 16, 2017

Is the RFC number here a typo (under "RFC 3597 syntax"):

...works with all raw RFC3457 TYPExxx records...

Copy link

ghost commented Aug 16, 2017

Hurricane Electric now supports CAA records - on their site under 'Recent Additions', and verified working with my own account & SSL Labs testing. Thank you for tracking these.

@roycewilliams
Copy link
Author

@C4llumD - good catch, fixed, thanks!

@10bass - updated - thanks!

Copy link

ghost commented Aug 22, 2017

It looks like iwantmyname has added support, but currently requires a support request to add the records: support center article

@roycewilliams
Copy link
Author

@10bass - copy that, added - thanks!

@wolfgang42
Copy link

Namecheap says "we are planning to implement CAA records[...], yet there is no ETA for this at the moment."

@spaze
Copy link

spaze commented Sep 9, 2017

Digital Ocean seems to support CAA now: How To Create and Manage CAA Records Using DigitalOcean DNS

@roycewilliams
Copy link
Author

@wolfgang42, @spaze - updated, thanks!

@timscha
Copy link

timscha commented Sep 11, 2017

123domain.eu also supports CAA records

@mi-sc
Copy link

mi-sc commented Sep 11, 2017

core-networks.de supports CAA too.

@kepi
Copy link

kepi commented Sep 17, 2017

igloonet.cz supports CAA too.

@blunden
Copy link

blunden commented Sep 20, 2017

ZoneEdit is working on it but no estimate other than "soon" given.

http://forum.zoneedit.com/index.php?threads/is-caa-supported-on-zoneedit.6093/

Copy link

ghost commented Sep 25, 2017

@CRCinAU
Copy link

CRCinAU commented Oct 6, 2017

Doing some investigations - I looked at this site to generate CAA records: https://sslmate.com/caa/

I can't get any of the output of the one liners to match the output of its RFC 3597 output.

Is there any way to verify this?

@ancarda
Copy link

ancarda commented Oct 18, 2017

Linode has quietly added support for adding CAA records, but unfortunately there's no blog post. You can see it at the bottom of a zone in the DNS Manager.

@bviktor
Copy link

bviktor commented Oct 24, 2017

@phizev
Copy link

phizev commented Aug 18, 2018

SSLMate has what appears to be a fairly comprehensive list of DNS providers supporting CAA:
https://sslmate.com/caa/support

@kuvam
Copy link

kuvam commented Jun 4, 2020

GeoScaling does not support CAA records as of the time of writing this.

@Andy-2639
Copy link

Andy-2639 commented Nov 11, 2023

@Andy-2639
Copy link

No-IP seems to support CAA: SSLMate/caa_helper#117

@azizarnold
Copy link

We at Hostking.host also support CAA Records via our Control Panel.

@Andy-2639
Copy link

No-IP is listed as CAA supported and CAA support status unknown (can you help?).
The entry in CAA support status unknown (can you help?) can be deleted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment