Add a CAA typed record builder for RFC 8659.

CheckDNS needs this so domain files with CAA records can be reconciled instead of failing the zone check.

Co-authored-by: Cursor <cursoragent@cursor.com>

record.go

@@ -124,6 +124,16 @@ func PTR(owner string, ttl uint32, target string) (Record, error) {
 	return fromRR(&dns.PTR{Hdr: rrHeader(owner, dns.TypePTR, ttl), Ptr: name})
 }
 
+// CAA builds a certification-authority authorization record (RFC 8659).
+func CAA(owner string, ttl uint32, flag uint8, tag, value string) (Record, error) {
+	return fromRR(&dns.CAA{
+		Hdr:   rrHeader(owner, dns.TypeCAA, ttl),
+		Flag:  flag,
+		Tag:   tag,
+		Value: value,
+	})
+}
+
 // rrHeader builds an INET header. Owner ASCII is checked in fromRR.
 func rrHeader(owner string, typ uint16, ttl uint32) dns.RR_Header {
 	name, err := fqdnASCII(owner)