Embed Notice

@feld I agree that DNS-01 should be pushed, and pinned. ACME tools should check for CAA records and recommend they be added.

But IMO you should never let any tool on an internet-facing server edit your zone directly, or an attacker compromising the server can also edit your zone.

Instead you should make CNAMEs for the _acme-challenge records to a dedicated subzone which is used exclusively for ACME challenges. This has all the advantages of DNS-01, but doesn't hand over control of your zone :)