0

I have a domain, let's say sameer.com, managed in namecheap.
And a domain, product.com, managed in AWS Route53.

The following DNS records exist for sameer.com:
CNAME quotes.sameer.com sameer.product.com
CAA sameer.com 0 issue "lenscrypt.org"

And the following records for product.com:
A *.product.com <AWS_LOADBALANCER>

Now if I run dig quotes.sameer.com, it resolves to the AWS loadbalancer IP addresses.

So far so good.

Now, if I try to issue a certificate through AWS, for domain quotes.sameer.com, ACM throws a CAA error, because Amazon is not allowed to issue certificate.

Now there are 2 things I can do.

  1. Add a CAA record under root domain sameer.com (in namecheap)
  2. Add a CAA record under sameer.product.com (in Route53)

Now if I add the CAA record
CAA sameer.product.com 0 issue "amazon.com",
AWS is able to issue the certificate successfully.

However, once I add this CAA record, the dig quotes.sameer.com command is not resolving.
When I ping quotes.sameer.com, it says "Unknown Host".

I don't think CAA record should interfere while resolving a CNAME.
Please help. What am I missing here?

2 Answers 2

1

You need to understand how CNAME & CAA records work.

RFC 2181, 10.1 CNAME resource records

The DNS CNAME ("canonical name") record exists to provide the canonical name associated with an alias name. There may be only one such canonical name for any one alias. That name should generally be a name that exists elsewhere in the DNS, though there are some rare applications for aliases with the accompanying canonical name undefined in the DNS. An alias name (label of a CNAME record) may, if DNSSEC is in use, have SIG, NXT, and KEY RRs, but may have no other data.

On the other hand, RFC 6844, 3 defines that...

Multiple properties MAY be associated with the same domain name by publishing multiple CAA RRs at that domain name.

and...

The following property tags are defined:

  • issue <Issuer Domain Name> [; <name>=<value> ]*: The issue property entry authorizes the holder of the domain name or a party acting under the explicit authority of the holder of that domain name to issue certificates for the domain in which the property is published.

Possible solutions:

  • Add the CAA record at the domain APEX and keep using the CNAME:

    example.org.         CAA    0 issue "lenscrypt.org"
    example.org.         CAA    0 issue "amazon.com"
    quotes.example.org.  CNAME  example-org.example.com.
    
  • Add the CAA record and replace the CNAME with an A record. You would need to update the A record when the example-org.example.com. changes.

    example.org.         CAA    0 issue "lenscrypt.org"
    quotes.example.org.  CAA    0 issue "amazon.com"
    quotes.example.org.  A      192.0.2.1
    
  • Add the CAA record to the domain of the canonical (CNAME) hostname and keep using the CNAME, e.g.,

    example.org.              CAA    0 issue "lenscrypt.org"
    quotes.example.org.       CNAME  example-org.example.com.
    example-org.example.com.  CAA    0 issue "amazon.com"
    

    Here, alias quotes.example.org (#2; CNAME example-org.example.com.) would be searched for a CAA record before example.org (#3), because RFC 6844, 4 defines the order that way:

    For example, if a certificate is requested for X.Y.Z the issuer will search for the relevant CAA record set in the following order:

    1. X.Y.Z
    2. Alias (X.Y.Z)
    3. Y.Z
    4. Alias (Y.Z)
    5. Z
    6. Alias (Z)
    7. Return Empty

    However, parent domain(s) of an alias (here example.com) is missing from this order, so you would need to add a distinct CAA record for every subdomain.

5
  • Yes true. But in my case, this is a customer, and the customer doesn't want to add an amazon CAA record for the root domain. Mar 26 at 10:53
  • Then they must add an A record and the CAA record for the subdomain. That would require updating the A record every time the IP address changes, but is the way around the limitations of a CNAME. Mar 26 at 20:20
  • hmm... got it.. But since they have a CNAME record pointing to my domain, why can I not add the CAA under my domain? Since any DNS lookup will follow CNAME records right? Mar 27 at 5:53
  • I guess I can do what you suggested under my domain as well. Will try and get back Mar 27 at 7:16
  • Sure, that's possible, too. I've updated my answer to cover all three alternative solutions. Mar 27 at 13:47
0

This was fixed. Thanks to @Esa Jokinen
dig quotes.sameer.com was not resolving after I added the CAA record because when a specific resource set is found (regardless of it being A record, CAA etc), it will not check the wildcard of the same domain which in my case is *.product.com

So
CAA sameer.product.com 0 issue "amazon.com"
hides
A *.product.com <AWS_LOADBALANCER>

So the solution was to add another A record for sameer.product.com:
A sameer.product.com <AWS_LOADBALANCER>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .