CAA records were introduced to Azure DNS in November 2017.

Today, I attempted to add one to a new DNS zone I created in US East 2.

I used the cloud Powershell so I wouldn't have to wrestle with AzureRM module version problems.

$records = @()
$records += New-AzureRmDnsRecordConfig -Caaflags 0 -CaaTag "issue" -CaaValue "issuernumberone.com"
$records += New-AzureRmDnsRecordConfig -Caaflags 0 -CaaTag "issue" -CaaValue "issuernumbertwo.org"
$records += New-AzureRmDnsRecordConfig -Caaflags 0 -CaaTag "iodef" -CaaValue "mailto:me@mydomain.com"
New-AzureRmDnsRecordSet -Name "caa" -RecordType CAA -ZoneName mydomain.com -ResourceGroupName DNS-rg -Ttl 3600 -DnsRecords $records

Get-AzureRmDnsRecordSet -RecordType CAA -ZoneName mydomain.com -ResourceGroupName DNS-rg

The commands all worked flawlessly. I was able to create and save the recordset. I was able to retrieve the recordset.

But dig tells another story.

$ dig mydomain.com @ns1-03.azure-dns.com. CAA

; <<>> DiG 9.10.3-P4 <<>> mydomain.com @ns1-03.azure-dns.com. CAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51663
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

; EDNS: version: 0, flags:; udp: 4000
;mydomain.com.                        IN      CAA

mydomain.com.         300     IN      SOA     ns1-03.azure-dns.com. azuredns-hostmaster.microsoft.com. 1 3600 300 2419200 300

;; Query time: 39 msec
;; WHEN: Fri Apr 06 16:29:56 Central Daylight Time 2018
;; MSG SIZE  rcvd: 126

I have other DNS providers with working CAA records. These results are not correct. I also tried with "type257" instead of CAA.

Furthermore, the CAA record type does not appear in the Azure DNS portal blade.


My intention was to put a CAA record on the root domain. I misunderstood the purpose of the -name parameter. I assumed it was just a label. I incorrectly set the -name parameter to caa. The correct usage would have been -name "@".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.