From e8e0964dce87492bd2f1c0b62873027d57b66da2 Mon Sep 17 00:00:00 2001 From: crystal Date: Sat, 11 Jul 2026 13:20:58 -0600 Subject: [PATCH] DNSSEC clarifications Missed a spot in #836 because DNSSEC was spelled weird. Also moved the useful link to the DNSSEC verification tool to more relevant secions. --- content/codeberg-pages/using-custom-domain.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content/codeberg-pages/using-custom-domain.md b/content/codeberg-pages/using-custom-domain.md index 590a8c3..c4b4678 100644 --- a/content/codeberg-pages/using-custom-domain.md +++ b/content/codeberg-pages/using-custom-domain.md @@ -30,9 +30,6 @@ This means you need to add two extra CAA records. The first record has a value of `letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/292520050;validationmethods=tls-alpn-01,http-01`. The second record has a value of `letsencrypt.org;accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/272029763;validationmethods=tls-alpn-01,http-01`. -If you're using [DNSSec](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) on your custom domain, you might run into TLS certificate issues because `codeberg.page` doesn't use DNSSec at the moment. -In this case you must add `A` / `AAAA` / `TXT` records for all domains instead of `CNAME` records. You can use [this tool](https://dnssec-analyzer.verisignlabs.com) to verify your setup. - {% endadmonition %} _We assume for the following description, that you want to serve your website with and without www in front. @@ -72,7 +69,7 @@ In the end, it should look like this: {% admonition "info" "Notice" %} -DNSSEC has now been enabled for `codeberg.page`, try using a CNAME record if your zone is signed! +DNSSEC has now been enabled for `codeberg.page`, try using a CNAME record if your zone is signed! You can verify that your DNSSEC setup works properly using [this tool](https://dnssec-analyzer.verisignlabs.com). {% endadmonition %} @@ -111,7 +108,7 @@ In this case, some DNS providers support an ALIAS record, which will work instea This type of record is not supported in conjunction with DNSSEC signed zones, which may cause unexpected behavior with your domain if your domain's zone is signed and a client is using a DNSSEC validating resolver. -If you have DNSSEC enabled, you should use A/AAAA records for now. +If you have DNSSEC enabled, you should use A/AAAA records for now. You can verify that your DNSSEC setup works properly using [this tool](https://dnssec-analyzer.verisignlabs.com). {% endadmonition %}