dns: configure CAA records for all domains
Going forward the only valid certificate authority tht can issue new certificates is Let's encrypt. No wildcard certificates are allowed. Fixes: #877
Martin Weinelt committed
Nov 4, 2025 at 19:41 UTC
00b801ba8781eff37a3e7ae62f08454bb5dc1ba9
4 files changed
+40
dns/nix.dev.js
+10
@@ -2,6 +2,16 @@ D("nix.dev",
2
REG_NONE,
3
DnsProvider(DSP_GANDI),
4
5
+ CAA_BUILDER({
6
+ label: "@",
7
+ iodef: "mailto:infra+caa@nixos.org",
8
+ iodef_critical: true,
9
+ issue: ["letsencrypt.org"],
10
+ issue_critical: true,
11
+ issuewild: "none",
12
+ issuewild_critical: true,
13
+ }),
14
+
15
// Domain is not used for mail
16
SPF_BUILDER({
17
label: "@",
dns/nixcon.org.js
+10
@@ -2,6 +2,16 @@ D("nixcon.org",
2
REG_NONE,
3
DnsProvider(DSP_GANDI),
4
5
+ CAA_BUILDER({
6
+ label: "@",
7
+ iodef: "mailto:infra+caa@nixos.org",
8
+ iodef_critical: true,
9
+ issue: ["letsencrypt.org"],
10
+ issue_critical: true,
11
+ issuewild: "none",
12
+ issuewild_critical: true,
13
+ }),
14
+
15
MX("@", 10, "umbriel.nixos.org."),
16
SPF_BUILDER({
17
label: "@",
dns/nixos.org.js
+10
@@ -8,6 +8,16 @@ D("nixos.org",
8
// bluesky account/domain binding
9
TXT("_atproto", "did=did:plc:bf43o4nxudgubwt4iljpayb7"),
10
11
+ CAA_BUILDER({
12
+ label: "@",
13
+ iodef: "mailto:infra+caa@nixos.org",
14
+ iodef_critical: true,
15
+ issue: ["letsencrypt.org"],
16
+ issue_critical: true,
17
+ issuewild: "none",
18
+ issuewild_critical: true,
19
+ }),
20
+
21
// nixos.org mailing
22
MX("@", 10, "umbriel"),
23
SPF_BUILDER({
dns/ofborg.org.js
+10
@@ -2,6 +2,16 @@ D("ofborg.org",
2
REG_NONE,
3
DnsProvider(DSP_GANDI),
4
5
+ CAA_BUILDER({
6
+ label: "@",
7
+ iodef: "mailto:infra+caa@nixos.org",
8
+ iodef_critical: true,
9
+ issue: ["letsencrypt.org"],
10
+ issue_critical: true,
11
+ issuewild: "none",
12
+ issuewild_critical: true,
13
+ }),
14
+
15
// Domain is not used for mail
16
SPF_BUILDER({
17
label: "@",