CAA records were introduced to Azure DNS in November 2017.
Today, I attempted to add one to a new DNS zone I created in US East 2.
I used the cloud Powershell so I wouldn't have to wrestle with AzureRM module version problems.
$records = @() $records += New-AzureRmDnsRecordConfig -Caaflags 0 -CaaTag "issue" -CaaValue "issuernumberone.com" $records += New-AzureRmDnsRecordConfig -Caaflags 0 -CaaTag "issue" -CaaValue "issuernumbertwo.org" $records += New-AzureRmDnsRecordConfig -Caaflags 0 -CaaTag "iodef" -CaaValue "mailto:email@example.com" New-AzureRmDnsRecordSet -Name "caa" -RecordType CAA -ZoneName mydomain.com -ResourceGroupName DNS-rg -Ttl 3600 -DnsRecords $records Get-AzureRmDnsRecordSet -RecordType CAA -ZoneName mydomain.com -ResourceGroupName DNS-rg
The commands all worked flawlessly. I was able to create and save the recordset. I was able to retrieve the recordset.
But dig tells another story.
$ dig mydomain.com @ns1-03.azure-dns.com. CAA ; <<>> DiG 9.10.3-P4 <<>> mydomain.com @ns1-03.azure-dns.com. CAA ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51663 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;mydomain.com. IN CAA ;; AUTHORITY SECTION: mydomain.com. 300 IN SOA ns1-03.azure-dns.com. azuredns-hostmaster.microsoft.com. 1 3600 300 2419200 300 ;; Query time: 39 msec ;; SERVER: 22.214.171.124#53(126.96.36.199) ;; WHEN: Fri Apr 06 16:29:56 Central Daylight Time 2018 ;; MSG SIZE rcvd: 126
I have other DNS providers with working CAA records. These results are not correct. I also tried with "type257" instead of CAA.
Furthermore, the CAA record type does not appear in the Azure DNS portal blade.