*.lisp: Add CAA records to discourage wrong CAs from issuing.

[zones] / distorted.lisp

diff --git a/distorted.lisp b/distorted.lisp
index 9ce7fa8..e17768b 100644 (file)
--- a/distorted.lisp
+++ b/distorted.lisp
@@ -74,8 +74,13 @@
        #+view/inside (vampire.ns :ip vampire)
        #-view/inside (mythic-beasts-1.ns :ip mythic-ns1)
        #-view/inside (mythic-beasts-2.ns :ip mythic-ns2)
+       #-view/inside (mythic-beasts-3.ns :ip mythic-ns3)
        #-view/inside (chiark.ns :ip chiark.greenend.org.uk))
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers.
   ((@ mail blackhole) :mx mail :srv ((:smtp mail)))
   ((bugs) :ttl 300 :mx lists :srv ((:smtp bugs)))
@@ -327,8 +332,8 @@
   (dnserr :ns ((radius.ns.dnserr :ip radius.dmz)
               (vampire.ns.dnserr :ip vampire.dmz)
               (precision.ns.dnserr :ip precision.jump)
-              (telecaster.ns.dnserr :ip telecaster)
-              (national.ns.dnserr :ip national))
+              (telecaster.ns.dnserr :ip telecaster.jump)
+              (national.ns.dnserr :ip national.linode))
          :ds ((40945 :rsasha256 :sha1
                "f35b5d0b877b940e63ad1b3afc21d6ba83cd1b3b")
               (40945 :rsasha256 :sha256
@@ -353,6 +358,13 @@
   (invader :addr invader.safe)
   (marauder :addr marauder.safe))
 
+(defzone dyn.distorted.org.uk
+  :ns ((radius.ns :ip radius)
+       (vampire.ns :ip vampire)
+       (precision.ns :ip precision)
+       (telecaster.ns :ip telecaster)
+       (national.ns :ip national)))
+
 (defzone nicko.org
   (richmond :addr richmond.jump))
 
@@ -437,8 +449,20 @@
        telecaster.distorted.org.uk.
        national.distorted.org.uk.
        secondary-dns.co.uk.)
+  (0.7.3.6.8.6.4.6.1.0.0.0 :ns (radius.distorted.org.uk.
+                               vampire.distorted.org.uk.
+                               precision.distorted.org.uk.
+                               telecaster.distorted.org.uk.
+                               national.distorted.org.uk.))
   :reverse ((((:ipv6 distorted.org.uk-aaisp)))))
 
+(defrevzone (dhcp :family :ipv6)
+  :ns (radius.distorted.org.uk.
+       vampire.distorted.org.uk.
+       precision.distorted.org.uk.
+       telecaster.distorted.org.uk.
+       national.distorted.org.uk.))
+
 (defrevzone distorted.org.uk-jump
   :ns (radius.distorted.org.uk.
        vampire.distorted.org.uk.