add a hint about dnssec to the custom domains doc

This commit is contained in:
Florian Lackner 2026-02-28 19:45:55 +01:00
parent c8911bc862
commit 8d9150ff2a
No known key found for this signature in database

View file

@ -29,6 +29,9 @@ If you have a [CAA record](https://en.wikipedia.org/wiki/DNS_Certification_Autho
you must [explicitly allow Let's Encrypt in your CAA record](https://letsencrypt.org/docs/caa/).
The value of the CAA record would look like `letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/292520050;validationmethods=tls-alpn-01,http-01`.
If you're using [DNSSec](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) on your custom domain, you might run into TLS certificate issues because `codeberg.page` doesn't use DNSSec at the moment.
In this case you must add `A` / `AAAA` / `TXT` records for all domains instead of `CNAME` records. You can use [this tool](https://dnssec-analyzer.verisignlabs.com) to verify your setup.
{% endadmonition %}
For custom domains, two things are required: