dallasgroot/Documentation
1
0
Fork 0
mirror of https://codeberg.org/Codeberg/Documentation.git synced 2026-08-15 14:53:29 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

DNSSEC clarifications (#837)

Browse source 
Missed a spot in #836 because DNSSEC was spelled weird. Also moved the
useful link to the DNSSEC verification tool to more relevant secions.

Reviewed-on: https://codeberg.org/Codeberg/Documentation/pulls/837
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
This commit is contained in:
crystal 2026-07-12 01:23:29 +02:00 committed by Gusted
parent f350065a74
commit a973f58c31
1 changed files with 2 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
content/codeberg-pages/using-custom-domain.md
View file

@ -30,9 +30,6 @@ This means you need to add two extra CAA records.
The first record has a value of `letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/292520050;validationmethods=tls-alpn-01,http-01`.
The second record has a value of `letsencrypt.org;accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/272029763;validationmethods=tls-alpn-01,http-01`.
If you're using [DNSSec](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) on your custom domain, you might run into TLS certificate issues because `codeberg.page` doesn't use DNSSec at the moment.
In this case you must add `A` / `AAAA` / `TXT` records for all domains instead of `CNAME` records. You can use [this tool](https://dnssec-analyzer.verisignlabs.com) to verify your setup.
{% endadmonition %}
_We assume for the following description, that you want to serve your website with and without www in front.
@ -72,7 +69,7 @@ In the end, it should look like this:
{% admonition "info" "Notice" %}
DNSSEC has now been enabled for `codeberg.page`, try using a CNAME record if your zone is signed!
DNSSEC has now been enabled for `codeberg.page`, try using a CNAME record if your zone is signed! You can verify that your DNSSEC setup works properly using [this tool](https://dnssec-analyzer.verisignlabs.com).
{% endadmonition %}
@ -111,7 +108,7 @@ In this case, some DNS providers support an ALIAS record, which will work instea
This type of record is not supported in conjunction with DNSSEC signed zones, which may cause unexpected behavior with your domain if your domain's zone is signed and a client is using a DNSSEC validating resolver.
If you have DNSSEC enabled, you should use A/AAAA records for now.
If you have DNSSEC enabled, you should use A/AAAA records for now. You can verify that your DNSSEC setup works properly using [this tool](https://dnssec-analyzer.verisignlabs.com).
{% endadmonition %}