Follow aliases without climbing their tree
03A CAA query follows an alias, but an empty result resumes the parent search on the original name.
host.example.net is not a parent-search step in this example. Its CAA records are not inherited through the empty CNAME target. This is the RFC 8659 algorithm, not RFC 6844’s traversal.
Key idea: Alias resolution and the parent search are different operations.
Terms
- CAA
- Certification Authority Authorization: DNS policy checked by a CA before it issues a certificate.
- CA
- Certification Authority: an issuer of certificates under a stated certificate policy.
- Relevant RRset
- The first nonempty CAA resource-record set found by the RFC’s lookup algorithm. A set can contain several properties.
- Property tag
- The case-insensitive name of a CAA property, such as issue, issuewild or iodef.
- Wildcard name
- A certificate name beginning with *., such as *.example.com. For CAA lookup, remove that leading *. first.
- CP / CPS
- Certificate Policy / Certification Practices Statement. Section 3 allows an exception specified in the relevant CP or CPS; the worked examples assume none applies.
Rules & examples
Alias resolution and the parent search are different operations.
- For shop.example.com, the CAA query follows its CNAME to tenant.host.example.net. A nonempty CAA answer reached through that alias would immediately be the Relevant RRset (§3).
- If the alias-following CAA query returns empty, the next parent-search name is example.com, not host.example.net. CNAME and DNAME processing is left to DNS resolution (§§3,7).
- RFC 8659 obsoletes RFC 6844. Its simplified algorithm climbs only the original searched name’s parents; the earlier algorithm also climbed alias-target trees (§7). Do not teach the obsolete traversal as the current rule.
- The example assumes successful finite alias resolution. A resolver error or loop is not a valid empty CAA answer; this chapter does not prescribe resolver retry counts or a universal alias-chain limit.
Fictional names, inert records and simulated DNS answers. The examples assume no CP/CPS exception and no extra issuer-defined parameter constraint. Passing CAA does not satisfy the other checks needed to issue a certificate.
Sources
New to this? Start hereA quick picture + helpful background
Check the domain’s issuer list before signing
Imagine a certificate printer checking a domain’s published list of permitted signing organizations. That list is only one check before printing; it is not the later reader’s test of an existing certificate. This is an analogy for issuance policy, not a complete certificate system.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The replacement removes tree-climbing on alias targets. Alias-following DNS queries remain; an empty result continues with the original name’s parent.
Read the updated RFC section ↗