Adding to the answer by Patrick, primarily to clarify how one would actually produce the necessary dnsmasq config entry without relying on a third-party service to create it for you.
If you want to tell dnsmasq to serve some record type which it doesn't natively support you need to give it the exact record data that it should put on the wire.
Do note that DNS is a binary protocol, so dnsmasq needs the exact byte sequence that corresponds to your desired record data, not the friendly text representation that you are used to dealing with but which dnsmasq has no clue how to interpret into actual binary DNS format that is sent on the wire.
--dns-rr config option needs the following values:
Return an arbitrary DNS Resource Record. The number is the type of the record (which is always
in the C_IN class). The value of the record is given by the hex data,
which may be of the form 01:23:45 or 01 23 45 or 012345 or any mixture
Ie, you know the name (your domain name) and can trivially look up the RR-number (the numeric representation of the record type, again dnsmasq has no clue what
CAA is) values but need to somehow produce the wire-data formatting and encode that in hexadecimal to have something that works for hex data.
example.com. IN CAA 0 issue "letsencrypt.org"
257 (this is what corresponds to CAA)
hex data = the binary format described in the CAA spec, then encoded as a hexadecimal string
You could obviously do the work by hand (based on the spec), but to more conveniently generate the wire-format data, as per above, here's an example python script (requires the
dnspython package, typically installed with
name = "example.com"
rclass = dns.rdataclass.IN
rtype = dns.rdatatype.CAA
rdata = '0 issue "letsencrypt.org"'
rd = dns.rdata.from_text(rclass, rtype, rdata)
f = io.BytesIO()
wire_data = f.getvalue()
print "dnsmasq option: --dns-rr=" + name + "," + str(rtype) + "," + binascii.hexlify(wire_data)
dnsmasq option: --dns-rr=example.com,257,000569737375656c657473656e63727970742e6f7267