A single dnsExchangeTimeout around CheckCAA let slow empty answers at child names consume the budget before parent policy was queried. Give each label its own exchange timeout inside the climb instead. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>