2 Commits

Author	SHA1	Message	Date
Cursor Agent	3948f47354	Apply CAA exchange timeout per label ... A single dnsExchangeTimeout around CheckCAA let slow empty answers at child names consume the budget before parent policy was queried. Give each label its own exchange timeout inside the climb instead. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>	2026-07-24 23:08:37 +02:00
Cursor Agent	64ef051d18	Harden DNS CAA and TXT verification ... Extract shared DNS checks into dnsclient and fail closed on truncated or non-success CAA responses. Climb past eTLD+1, validate RFC 8659 issue-value syntax, and map NXDOMAIN TXT lookups to the pending-verification path. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>	2026-07-24 23:08:36 +02:00