I thought people might be interested to know: following the addition of support by AWS's Route53, we now have CAA records on the services.mozilla.com subdomain. gerv at wolf$ dig +short -t TYPE257 services.mozilla.com 0 issue "digicert.com" Support on mozilla.org is gated on support from Infoblox, scheduled for Q1 2018. Gerv