CAA record effect on CNAME subdomains

Help
1

My domain is:
prusa.net, status.prusa.net

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

GitHub Pages

Hello, I have a question about how CAA records affect domains with a CNAME record on them. This question came to my head after I realized that GitHub pages was able to create a Let's Encrypt certificate for my subdomain (status.prusa.net), despite my domain having bound a specific ACME account in CAA records:

$ dig +short CAA prusa.net
0 iodef "mailto:caa@prusa.net"
0 issue "letsencrypt.org; validationmethods=http-01; accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/246206403"
0 issue "letsencrypt.org; validationmethods=http-01; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/2564468501"
0 issuevmc ";"
0 issuemail ";"

I have set up GitHub pages on my domain by adding a CNAME record on the subdomain (status.prusa.net -> atmosphericignition.github.io).
I was surprised that GitHub was immediately able to issue a cert for the subdomain, without me having GitHub's ACME account in my CAA records. It makes me wonder if the issuing CAs consider CAA records for the answer domain (atmosphericignition.github.io) instead of the host domain (status.prusa.net). I haven't been able to find a definitive answer online.

Thank you.

CNAME validation
CNAME and CAA clarification
2

CAA lookups (RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record) use the algorithm specified in RFC 1034 Section 4.3.2 (RFC 1034: Domain names - concepts and facilities). In particular CNAMEs are followed when not looking up CNAME records i.e. when looking up CAA records.

2 Likes
3

A CNAME means "this record is actually over there". So the subdomain's CAA records are whatever the target name has for CAA records. And only if they aren't found, will the next higher-level domain level be checked.

7 Likes
4

Thank you both for the answers.

Does the same algorithm apply for ALIAS DNS records?

5

ALIAS DNS records do not really exist, they're just to instruct your authoritative DNS server to lookup the IP addresses of another domain and serve those addresses.

CAA records would have to be manually added if required as ALIAS records do not copy them.

3 Likes
6

"ALIAS" isn't an actual DNS record type, so it depends on what your DNS server actually does when you tell it to do an alias.

8 Likes