←back to thread

Mitigating the Hetzner/Linode XMPP.ru MitM interception incident

(www.devever.net)
341 points hlandau | 1 comments | 20 Oct 23 20:31 UTC | HN request time: 0.209s | source
Show context
mkj ◴[20 Oct 23 23:42 UTC] No.37962716[source]▶
I looked into CAA but the current dns provider doesn't support those records. Is there a reason it had to be a new type not a more common TXT record?
replies(3): >>37962777 #>>37964896 #>>37968114 #
1. rodlette ◴[21 Oct 23 07:45 UTC] No.37964896[source]▶
See RFC5507: "Why Adding a New Resource Record Type Is the Preferred Solution"

DNS providers should support a wide range of RR types, and domain owners should vote with their NS records.

See https://github.com/StackExchange/dnscontrol/blob/master/docu... for a list of DNS providers that support CAA.