I'm trying to add CAA records to my DNS server that uses dnsmasq, but haven't bee successfull. The CAA helper site tells me to use "--dns-rr=sitename" -option, but I have no idea where to put them. I tried adding it to /etc/dnsmasq.conf which gave me a syntax error. I also tried using it in command line, but that just tries to start the dnsmasq daemon itself.

So, the question is, how can I add a CAA record to dnsmasq?

  • What configuration did you try exactly and what error message precisely? Jun 3, 2018 at 23:05
  • @nyoatype For which release version of dnsmasq are you asking?
    – Pro Backup
    Aug 25, 2018 at 9:58
  • The version is 2.76-5
    – nyoatype
    Aug 27, 2018 at 10:29

3 Answers 3


You need to use the dns-rr keyword in configuration file, or --dns-rr on the command-line. dns-rr|--dns-rr is indeed the way to put any arbitrary DNS content besides the type dnsmasq knows about like A, MX, PTR, etc.

Note its use in manual:

--dns-rr=<name>,<RR-number>,[<hex data>]

Return an arbitrary DNS Resource Record. The number is the type of the record (which is always in the C_IN class). The value of the record is given by the hex data, which may be of the form 01:23:45 or 01 23 45 or 012345 or any mixture of these.

Of course the name is the easy part, it will be typically your domain name.

So, you first need to find the "RR type number" for CAA records. If you go to IANA registry on DNS RRtypes, and search for CAA you will see it is number 257. So 257 goes into the above RR-number part.

As for the hex-data part you need to take the content you wish to publish and encode it as hexadecimal data. Many tools can help you in that.

Alternatively, if you just go to https://sslmate.com/caa/, after filling out the form with all your details, you will see at bottom that it does everything for you and gives you exactly what you need to use in dnsmasq such as this example:


  • 1
    Regarding “many tools can help you with that”, I’m not so sure that these tools are particularly common. Might be worthwhile suggesting such a tool. The hexadecimal encoding is easy, but getting the wire-format dns rdata (the content you want to publish) for arbitrary record types is not so common in standalone tools. Jun 3, 2018 at 23:31
  • (Or, if there is no readily available tool, it might be more helpful to refer to tools.ietf.org/html/rfc6844#section-5 for how to create the value to hex-encode for the hex-data value) Jun 3, 2018 at 23:40
  • Thank you! I first tried to add the --dns-rr= with those -- in to the configuration file. You can guess it didn't work out.
    – nyoatype
    Jun 7, 2018 at 13:15
  • For "hex data" encoding have a look at stackoverflow.com/questions/6791798/… and don't forget to append the suggested | tr -d '\n'
    – Pro Backup
    Aug 8, 2018 at 18:53
  • @ProBackup That only covers the trivial aspect, which is to encode an existing value into a hexadecimal string. It doesn't help with the more involved process of interpreting eg 0 issue "letsencrypt.org" into DNS wire-format (a value which you could then pass to your suggested command). Aug 9, 2018 at 0:34

Adding to the answer by Patrick, primarily to clarify how one would actually produce the necessary dnsmasq config entry without relying on a third-party service to create it for you.

If you want to tell dnsmasq to serve some record type which it doesn't natively support you need to give it the exact record data that it should put on the wire.
Do note that DNS is a binary protocol, so dnsmasq needs the exact byte sequence that corresponds to your desired record data, not the friendly text representation that you are used to dealing with but which dnsmasq has no clue how to interpret into actual binary DNS format that is sent on the wire.

The --dns-rr config option needs the following values:

--dns-rr=<name>,<RR-number>,[<hex data>]
Return an arbitrary DNS Resource Record. The number is the type of the record (which is always in the C_IN class). The value of the record is given by the hex data, which may be of the form 01:23:45 or 01 23 45 or 012345 or any mixture of these.

Ie, you know the name (your domain name) and can trivially look up the RR-number (the numeric representation of the record type, again dnsmasq has no clue what CAA is) values but need to somehow produce the wire-data formatting and encode that in hexadecimal to have something that works for hex data.


example.com. IN CAA 0 issue "letsencrypt.org"

name = example.com
RR-number = 257 (this is what corresponds to CAA)
hex data = the binary format described in the CAA spec, then encoded as a hexadecimal string

You could obviously do the work by hand (based on the spec), but to more conveniently generate the wire-format data, as per above, here's an example python script (requires the dnspython package, typically installed with pip):

#!/usr/bin/env python
import dns.rdata
import io
import binascii

name = "example.com"
rclass = dns.rdataclass.IN
rtype = dns.rdatatype.CAA
rdata = '0 issue "letsencrypt.org"'

rd = dns.rdata.from_text(rclass, rtype, rdata)
f = io.BytesIO()
wire_data = f.getvalue()
print "dnsmasq option: --dns-rr=" + name + "," + str(rtype) + "," + binascii.hexlify(wire_data)

It outputs:

dnsmasq option: --dns-rr=example.com,257,000569737375656c657473656e63727970742e6f7267

DNSMASQ added a caa-record option in version 2.80, released in October 2018 (after the original accepted answer). I'm adding this answer since this is still the top result for "dnsmasq caa" on Google for me. Please note that the previous answer still works fine and is useful for older versions of DNSMASQ!

Manual Entry for caa-record

    Return a CAA DNS record, as specified in RFC6844.

Config File Example



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .