dnssec-signzone: error when CAA record exists

[TJ]

On 18.04 with bind9/bionic-updates,bionic-proposed,now 1:9.11.3+dfsg-1ubuntu1.9

When the zone file includes:

@ IN CAA "letsencrypt.org"

An error occurs when trying to sign the zone:

$ sudo dnssec-signzone -v 255 -o example.com example.com.hosts
dnssec-signzone: using 4 cpus
dnssec-signzone: error: dns_rdata_fromtext: example.com.hosts:14: not a valid number
dnssec-signzone: fatal: failed loading zone from 'example.com.hosts': not a valid number

This is unfortunate as it prevents achieving an optimum configuration including an advisory note from SSLLabs tests.

[Andreas Hasenack (ahasenack)]

Hello,

I believe your record has an incorrect syntax. It should be:

@ IN CAA <flag> issue <domain>

where <flag> is a number. Hence the complain from the tool that character position 14 is not a valid number.

The line you used gives an error already when reloading the zone, with the same message.

Can you please try the following:

@ IN CAA 0 issue "letsencrypt.org"

[Launchpad Janitor (janitor)]

[Expired for bind9 (Ubuntu) because there has been no activity for 60 days.]