3 ms·
Does it handle updating the domain's CAA record? Or do you have to not use CAA records when using this feature?
by Arnavion 5y ago
Does it handle updating the domain's CAA record? Or do you have to not use CAA records when using this feature?
- coder543 5y agoYou can have multiple CAA records for a domain. Given how slow DNS propagation is, rapidfire rewriting of CAA records as you failover to a different CA seems like a recipe for causing errors... which is the last thing you want as you're failing over. I did a quick google search, and nothing indicated that Caddy will manage CAA records for you, which sounds very sensible to me.
- Arnavion 5y agoHaving multiple CAA records seems to me to kind of defeat the purpose of having a CAA record in the first place. But I guess if you limit it to two or three it'd still be fine.
- majewsky 5y agoThe purpose of CAA records is mostly to exclude CAs you don't trust. It's less of a "I trust Let's Encrypt" and more of a "I don't trust Honest Achmed". (Context for "Honest Achmed": https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959)
- mholt 5y agoThis can be automated with DNS provider modules, if someone would like to implement it: https://github.com/caddy-dns https://github.com/caddy-dns