octodns.record.caa

Classes

CaaRecord(zone, name, data[, source, context])
CaaValue(value)
CaaValueBestPracticeValidator(id[, sets])	Checks that CAA records include an explicit issuewild property whenever an issue property is present.
CaaValueRfcValidator(id[, sets])	Strict CAA rdata validator per RFC 8659 §4.1.
CaaValueValidator(id[, sets])	Validates CAA rdata: flags is an integer in [0, 255], and tag and value are present.

class octodns.record.caa.CaaValueValidator(id, sets=None)

Bases: ValueValidator

Validates CAA rdata: flags is an integer in [0, 255], and tag and value are present.

validate(value_cls, data, _type)

Validate a record’s rdata values.

Parameters:

• value_cls (type) – The concrete value class being validated (e.g. MxValue, _Ipv4Value). Validators that need access to value class-level attributes (e.g. VALID_ALGORITHMS, _address_type) should read them from value_cls. Per-instance configuration should live on self, not on value_cls.

• data (list | tuple | str | dict) – The rdata to validate. For multi-value record types this is a list/tuple of value dicts or strings; for single-value types it may be a bare value. Most validators iterate data directly — when a validator needs to accept either form it should normalize with if not isinstance(data, (list, tuple)): data = (data,).

• _type (str) – The record type string (e.g. 'MX', 'A'). Passed through to helpers like _check_target_format which format it into their reason strings.

Returns:

A list of human-readable reason strings describing validation failures. Must return an empty list when the values are valid. Reasons from multiple validators are concatenated by the caller, so each reason must stand alone without context from the others.

Return type:

list[str]

Notes

Implementations must not raise on invalid input — all failures are reported via the returned list. Reason strings are surfaced verbatim in ValidationError messages, so phrasing and punctuation should be stable across releases.

class octodns.record.caa.CaaValueRfcValidator(id, sets=None)

Bases: ValueValidator

Strict CAA rdata validator per RFC 8659 §4.1.

• flags must be 0 or 128 — only bit 0 (Issuer Critical) is defined; all other bits are reserved and must be zero.

• tag must match [a-zA-Z0-9]+.

Enabled as part of the strict validator set:

manager:
  enabled:
    - strict

_tag_re = re.compile('^[a-zA-Z0-9]+$')

validate(value_cls, data, _type)

Validate a record’s rdata values.

Parameters:

• value_cls (type) – The concrete value class being validated (e.g. MxValue, _Ipv4Value). Validators that need access to value class-level attributes (e.g. VALID_ALGORITHMS, _address_type) should read them from value_cls. Per-instance configuration should live on self, not on value_cls.

• data (list | tuple | str | dict) – The rdata to validate. For multi-value record types this is a list/tuple of value dicts or strings; for single-value types it may be a bare value. Most validators iterate data directly — when a validator needs to accept either form it should normalize with if not isinstance(data, (list, tuple)): data = (data,).

• _type (str) – The record type string (e.g. 'MX', 'A'). Passed through to helpers like _check_target_format which format it into their reason strings.

Returns:

A list of human-readable reason strings describing validation failures. Must return an empty list when the values are valid. Reasons from multiple validators are concatenated by the caller, so each reason must stand alone without context from the others.

Return type:

list[str]

Notes

Implementations must not raise on invalid input — all failures are reported via the returned list. Reason strings are surfaced verbatim in ValidationError messages, so phrasing and punctuation should be stable across releases.

class octodns.record.caa.CaaValueBestPracticeValidator(id, sets=None)

Bases: ValueValidator

Checks that CAA records include an explicit issuewild property whenever an issue property is present.

Per RFC 8659 §4.2, wildcard certificate issuance falls back to issue policy when no issuewild record exists; omitting issuewild makes the wildcard-issuance policy implicit rather than explicit.

Enabled as part of the best-practice validator set:

manager:
  enabled:
    - best-practice

validate(value_cls, data, _type)

Validate a record’s rdata values.

Parameters:

• value_cls (type) – The concrete value class being validated (e.g. MxValue, _Ipv4Value). Validators that need access to value class-level attributes (e.g. VALID_ALGORITHMS, _address_type) should read them from value_cls. Per-instance configuration should live on self, not on value_cls.

• data (list | tuple | str | dict) – The rdata to validate. For multi-value record types this is a list/tuple of value dicts or strings; for single-value types it may be a bare value. Most validators iterate data directly — when a validator needs to accept either form it should normalize with if not isinstance(data, (list, tuple)): data = (data,).

• _type (str) – The record type string (e.g. 'MX', 'A'). Passed through to helpers like _check_target_format which format it into their reason strings.

Returns:

A list of human-readable reason strings describing validation failures. Must return an empty list when the values are valid. Reasons from multiple validators are concatenated by the caller, so each reason must stand alone without context from the others.

Return type:

list[str]

Notes

Implementations must not raise on invalid input — all failures are reported via the returned list. Reason strings are surfaced verbatim in ValidationError messages, so phrasing and punctuation should be stable across releases.

class octodns.record.caa.CaaValue(value)

Bases: EqualityTupleMixin, dict

VALIDATORS = [<octodns.record.caa.CaaValueValidator object>, <octodns.record.caa.CaaValueRfcValidator object>, <octodns.record.caa.CaaValueBestPracticeValidator object>]

classmethod _schema()

classmethod parse_rdata_text(value)

classmethod process(values)

__init__(value)

property flags

property tag

property value

property data

property rdata_text

template(params)

_equality_tuple()

__repr__()

Return repr(self).

class octodns.record.caa.CaaRecord(zone, name, data, source=None, context=None)

Bases: ValuesMixin, Record

REFERENCES = ('https://datatracker.ietf.org/doc/html/rfc8657', 'https://datatracker.ietf.org/doc/html/rfc8659', 'https://datatracker.ietf.org/doc/html/rfc9495')

_type = 'CAA'

_value_type

alias of CaaValue