[jaspermayone]

Add rule 8 to tools/check_zones.py. A typo in a CAA record, such as letsencrypt.com, now fails ./bin/validate. Without this rule, the typo fails at the next certificate renewal.

The rule fails when:

• A CAA issue or issuewild record names a CA that is not in KNOWN_CAS (letsencrypt.org, pki.goog, sectigo.com, ssl.com). To allow a new CA, add it to KNOWN_CAS in the same pull request.
• The tag is not issue, issuewild or iodef, or the flags are not the number 0 or 128.
• An iodef value does not start with mailto: or https://.
• The apex has CAA issue records and they do not include letsencrypt.org. Vercel, Traefik on alastor and the thimble VPN get certificates from Let's Encrypt.

flowchart TD
  R[CAA value] --> T{tag}
  T -->|issue / issuewild| C{"CA (lower case, no params, no trailing dot) in KNOWN_CAS?"}
  T -->|iodef| I{mailto: or https://?}
  T -->|other| E1[error]
  C -->|no| E2[error]
  I -->|no| E3[error]
  A["apex issue set"] --> L{"includes letsencrypt.org?"}
  L -->|no| E4[error]

Loading

The CA match ignores case, a trailing dot and the parameters after ;. An empty CA (;) is allowed. If the apex has no issue record, RFC 8659 lets every CA issue, so the Let's Encrypt rule does not apply.

This PR does not depend on #15. The zone file in #15 passes this rule.

Tests

• 20 new tests in tools/test_check_zones.py. All 66 tool tests pass.
• ./bin/validate passes on this branch.
• The README rule list and CLAUDE.md are updated.

[github-actions]

octoDNS plan

This pull request changes no DNS records.

---

Planned against main with a read-only Cloudflare token. Only the zone files at the repository root are included. Changes to config/, bin/ or .github/ are not in this plan, so review those by hand.