CAA Mandated by CA/Browser Forum

[candrews]

Since CAA is now mandated by the CA/Browser Forum, can you please add support for it to the primary DNS configuration interface?

https://blog.qualys.com/ssllabs/2017/03 ... wser-forum

[Seth]

We have to upgrade all of the background PowerDNS infrastructure before we can add support for CAA records since the version we're currently running doesn't understand it. I don't have an ETA for this, but it's in the queue.

[dstutz]

Just wanted to say I'm interested in this feature as well. Thanks guys!

Also, are you aware the forums are using a staging LE cert?

[Seth]

We're not redirecting HTTP into HTTPS yet, it's just for testing.

[Seth]

We're not redirecting HTTP into HTTPS yet, it's just for testing.

OK, everything should be all settled now. The redirect to HTTPS is in place and the certs are non-staging.

[candrews]

We have to upgrade all of the background PowerDNS infrastructure before we can add support for CAA records since the version we're currently running doesn't understand it. I don't have an ETA for this, but it's in the queue.

Do you have any update as to when CAA records may be available?

Thanks again!

[Seth]

I don't have a timeframe. I'm still working on slowly stepping through upgrades to PowerDNS to ensure nothing breaks horribly when I have to make major schema changes.

[candrews]

Sorry to be annoying, but I couldn't resist the urge to bump this request again

[candrews]

I'm cordially requesting any news on this topic.

Thanks again!

[Seth]

Still working on the upgrades to PowerDNS. When we first started using it they didn't have an API so we ended up having to do some command line output parsing to implement the DNSSEC features, which is totally not ideal (and I wouldn't have done it if there was another way) because any output formatting changes can break those kind of parsers.

I may just end up doing the best I can with looking for changes and expect some bug reports to come in that require fixing. Obviously I want to make sure that the actual serving of domain data doesn't break and any bug is limited to trying to make a change in the control center.

[candrews]

Do you have an update on this topic?

Thanks!

[Seth]

I'm working on the last round of backend updates today before we progress to the next update that will add new record types.

[candrews]

Do you have an update on this topic?

Thanks!

[Seth]

Not yet.

[candrews]

Do you have an update on this topic?

Thanks!