How to add a CAA record to dnsmasq?

Question

I'm trying to add CAA records to my DNS server that uses dnsmasq, but haven't bee successfull. The CAA helper site tells me to use "--dns-rr=sitename" -option, but I have no idea where to put them. I tried adding it to /etc/dnsmasq.conf which gave me a syntax error. I also tried using it in command line, but that just tries to start the dnsmasq daemon itself.

So, the question is, how can I add a CAA record to dnsmasq?

Answer 1

You need to use the dns-rr keyword in configuration file, or --dns-rr on the command-line. dns-rr|--dns-rr is indeed the way to put any arbitrary DNS content besides the type dnsmasq knows about like A, MX, PTR, etc.

Note its use in manual:

--dns-rr=<name>,<RR-number>,[<hex data>]

Return an arbitrary DNS Resource Record. The number is the type of the record (which is always in the C_IN class). The value of the record is given by the hex data, which may be of the form 01:23:45 or 01 23 45 or 012345 or any mixture of these.

Of course the name is the easy part, it will be typically your domain name.

So, you first need to find the "RR type number" for CAA records. If you go to IANA registry on DNS RRtypes, and search for CAA you will see it is number 257. So 257 goes into the above RR-number part.

As for the hex-data part you need to take the content you wish to publish and encode it as hexadecimal data. Many tools can help you in that.

Alternatively, if you just go to https://sslmate.com/caa/, after filling out the form with all your details, you will see at bottom that it does everything for you and gives you exactly what you need to use in dnsmasq such as this example:

--dns-rr=example.com,257,000569737375653B

Answer 2

Adding to the answer by Patrick, primarily to clarify how one would actually produce the necessary dnsmasq config entry without relying on a third-party service to create it for you.

If you want to tell dnsmasq to serve some record type which it doesn't natively support you need to give it the exact record data that it should put on the wire.
Do note that DNS is a binary protocol, so dnsmasq needs the exact byte sequence that corresponds to your desired record data, not the friendly text representation that you are used to dealing with but which dnsmasq has no clue how to interpret into actual binary DNS format that is sent on the wire.

The --dns-rr config option needs the following values:

--dns-rr=<name>,<RR-number>,[<hex data>]
Return an arbitrary DNS Resource Record. The number is the type of the record (which is always in the C_IN class). The value of the record is given by the hex data, which may be of the form 01:23:45 or 01 23 45 or 012345 or any mixture of these.

Ie, you know the name (your domain name) and can trivially look up the RR-number (the numeric representation of the record type, again dnsmasq has no clue what CAA is) values but need to somehow produce the wire-data formatting and encode that in hexadecimal to have something that works for hex data.

Example:

example.com. IN CAA 0 issue "letsencrypt.org"

name = example.com
RR-number = 257 (this is what corresponds to CAA)
hex data = the binary format described in the CAA spec, then encoded as a hexadecimal string

You could obviously do the work by hand (based on the spec), but to more conveniently generate the wire-format data, as per above, here's an example python script (requires the dnspython package, typically installed with pip):

#!/usr/bin/env python
import dns.rdata
import io
import binascii

name = "example.com"
rclass = dns.rdataclass.IN
rtype = dns.rdatatype.CAA
rdata = '0 issue "letsencrypt.org"'


rd = dns.rdata.from_text(rclass, rtype, rdata)
f = io.BytesIO()
rd.to_wire(f)
wire_data = f.getvalue()
print "dnsmasq option: --dns-rr=" + name + "," + str(rtype) + "," + binascii.hexlify(wire_data)

It outputs:

dnsmasq option: --dns-rr=example.com,257,000569737375656c657473656e63727970742e6f7267

Answer 3

DNSMASQ added a caa-record option in version 2.80, released in October 2018 (after the original accepted answer). I'm adding this answer since this is still the top result for "dnsmasq caa" on Google for me. Please note that the previous answer still works fine and is useful for older versions of DNSMASQ!

Manual Entry for caa-record

--caa-record=<name>,<flags>,<tag>,<value>
    Return a CAA DNS record, as specified in RFC6844.

Config File Example

caa-record=example.com,0,issue,digicert.com

Reference

• /dnsmasq/docs/dnsmasq-man
• /dnsmasq/CHANGELOG