Add iodef property to opentelemetry.io CAA record

[mx-psi]

CAA records allow setting an iodef property (see e.g. Wikipedia article or RFC section) where one can put a way to report attempts to issue a certificate that failed due to the CAA record. For example:

report.example.com         CAA 0 iodef "mailto:[email protected]"

means that [email protected] would get an email if a certificate authority attempted to issue a certificate for a domain and was prevented from doing so by the CAA record.

Note that support for this is not widespread, so it would not be a foolproof solution.

Motivated by open-telemetry/opentelemetry-go-vanityurls/issues/81.

[svrnm]

Netlify allows us to set such a CAA entry, do we know how this added entry interacts with the existing ones? Based on the following issue it seems not to be a good idea:

https://answers.netlify.com/t/cca-error-when-renewing-netlify-lets-encrypt-ssl-certificate/75052?utm_source=chatgpt.com

If the opentelemetry-go-vanityurls run as a netlify deployment I suspect this is going to be managed by them

[mx-psi]

@austinlparker and @jsuereth should know how this was set up. The current CAA record affects both opentelemetry.io and all its subdomains

[austinlparker]

if we make an iodef record for the apex domain does it report failed issuances for all subdomains?

[mx-psi]

That is my understanding from the RFC, yes (provided the certificate authority attempting to issue the certificate supports this)