From 782a3c7ac60c82311fe9fb8889dd843dfe26c0bc Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Mon, 24 Mar 2025 09:55:26 -0600 Subject: [PATCH] caddytls: Don't publish HTTPS record for CNAME'd domain (fix #6922) --- modules/caddytls/ech.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/modules/caddytls/ech.go b/modules/caddytls/ech.go index a192c3390..142cf48d6 100644 --- a/modules/caddytls/ech.go +++ b/modules/caddytls/ech.go @@ -630,6 +630,7 @@ func (dnsPub ECHDNSPublisher) PublisherKey() string { func (dnsPub *ECHDNSPublisher) PublishECHConfigList(ctx context.Context, innerNames []string, configListBin []byte) error { nameservers := certmagic.RecursiveNameservers(nil) // TODO: we could make resolvers configurable +nextName: for _, domain := range innerNames { zone, err := certmagic.FindZoneByFQDN(ctx, dnsPub.logger, domain, nameservers) if err != nil { @@ -660,6 +661,14 @@ func (dnsPub *ECHDNSPublisher) PublishECHConfigList(ctx context.Context, innerNa var nameHasExistingRecord bool for _, rec := range recs { if rec.Name == relName { + // CNAME records are exclusive of all other records, so we cannot publish an HTTPS + // record for a domain that is CNAME'd. See #6922. + if rec.Type == "CNAME" { + dnsPub.logger.Warn("domain has CNAME record, so unable to publish ECH data to HTTPS record", + zap.String("domain", domain), + zap.String("cname_value", rec.Value)) + continue nextName + } nameHasExistingRecord = true if rec.Type == "HTTPS" && (rec.Target == "" || rec.Target == ".") { httpsRec = rec