How to reproduce CAA SERVFAIL? Works for me, doesn't for LE staging or prod

[cpu]

@coolaj86

I’d like to be able too see why LE doesn’t like our responses so that I can fix them (it’s probably our fault), but I haven’t been able to produce a query that fails in the way that LE is reporting the failure.

Have you tried with https://unboundtest.com/ ? You could run your own Unbound instance with a similar config as well.

@coolaj86

Also, since yahoo’s nameserver responds the same as ours, it would seem to me that we’re not “doing it wrong” (unless they’re also doing it wrong, which I doubt).

One thing to note is that you aren't testing with DNSSEC validation which is often a source of SERVFAILs, especially in conjunction with CAA. For instance our CAA docs page's section on SERVFAIL errors mentions one PowerDNS bug that manifested with DNSSEC and CAA records.