Add CAA DNS Records
https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization#Mandatory_checking
Mandatory checking
Originally the implementation of CAA was voluntary: CAs could decide whether they would check for the records or not. However, in March 2017 the CA/Browser Forum voted in favor of a rule that will make CAA mandatory for all certificate authorities.[6] Starting September 2017 all certificate authorities have to implement CAA checking.
Anonymous
shared this idea
While it is mandatory for a CA to check for a CAA record if no record is found the CA still must issue the cert. Basically if the record exists it must follow that procedure otherwise if no record exists it can continue as intended. This has been completed.
-
While it is mandatory for a CA to check for a CAA record if no record is found the CA still must issue the cert. Basically if the record exists it must follow that procedure otherwise if no record exists it can continue as intended. This has been completed.
-
Anonymous
commented
https://community.letsencrypt.org/t/caa-servfail-changes/38298
https://community.letsencrypt.org/t/help-diagnosing-caa-servfail/38460/3I might be wrong, but...
it seems that your name servers are responding with SERVFAIL to all CAA queries.Warren