Change #1297210 had a related patch set uploaded (by BCornwall; author: BCornwall):

[operations/dns@master] Remove digicert CAA records from most domains

https://gerrit.wikimedia.org/r/1297210

CAA works at the subdomain level so we can set the records for payments.wikimedia.org to allow them their issuance while removing the unnecessary records for the rest of the stack.

So payments is a CNAME and hence we can't add a CAA record for it. That leaves us with the option of either removing the CNAME, or just having fr-tech switch to pki.goog as we have done in production, but that's a longer conversation.

In T428093#11982860, @ssingh wrote:

So payments is a CNAME and hence we can't add a CAA record for it.

Can we not add a CAA record to the CNAME targets (payments-eqiad/codfw)?

In T428093#11982863, @taavi wrote:

In T428093#11982860, @ssingh wrote:

So payments is a CNAME and hence we can't add a CAA record for it.

Can we not add a CAA record to the CNAME targets (payments-eqiad/codfw)?

We can yeah but I am not sure if there is something in the fr-tech setup that complicates that. @Jgreen can comment on those bits.

Change #1297210 merged by BCornwall:

[operations/dns@master] Remove digicert CAA records from most domains

https://gerrit.wikimedia.org/r/1297210