Looks like we may not be completely out of the woods yet.
I have a new case that popped up today for domains hosted by ezyreg.com, another Netregistry reseller.
The same CAA via UDP timeout issue remains there.
Here’s the example…
This CAA check via UDP fails with timeout
dig CAA drumdigital.com.au. @ns-1.ezyreg.com. +notcp
; <<>> DiG 9.10.2 <<>> CAA drumdigital.com.au. @ns-1.ezyreg.com. +notcp
;; global options: +cmd
;; connection timed out; no servers could be reached
This CAA check via TCP works
dig CAA drumdigital.com.au. @ns-1.ezyreg.com. +tcp
; <<>> DiG 9.10.2 <<>> CAA drumdigital.com.au. @ns-1.ezyreg.com. +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33240
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;drumdigital.com.au. IN CAA
;; AUTHORITY SECTION:
drumdigital.com.au. 86400 IN SOA ns-1.ezyreg.com. cpanel.netregistry.com.au. 2017050100 86400 7200 3600000 86400
;; Query time: 315 msec
;; SERVER: 180.235.128.119#53(180.235.128.119)
;; WHEN: Wed May 03 15:12:49 Eastern Daylight Time 2017
;; MSG SIZE rcvd: 117