3 ms·
You can have multiple CAA records for a domain. Given how slow DNS propagation is, rapidfire rewriting of CAA records as you failover to a different CA seems l
by coder543 5y ago
You can have multiple CAA records for a domain.
Given how slow DNS propagation is, rapidfire rewriting of CAA records as you failover to a different CA seems like a recipe for causing errors... which is the last thing you want as you're failing over.
I did a quick google search, and nothing indicated that Caddy will manage CAA records for you, which sounds very sensible to me.
- Arnavion 5y agoHaving multiple CAA records seems to me to kind of defeat the purpose of having a CAA record in the first place. But I guess if you limit it to two or three it'd still be fine.
- majewsky 5y agoThe purpose of CAA records is mostly to exclude CAs you don't trust. It's less of a "I trust Let's Encrypt" and more of a "I don't trust Honest Achmed". (Context for "Honest Achmed": https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959)