CAA Record Builder

Creates presentation-format CAA records from the supplied fields. Property tags are non-empty case-insensitive ASCII alphanumeric strings; `issue`, `issuewild`, and `iodef` are recognized, while valid unknown tags are preserved. Reserved flag bits must be clear, so flags are 0 or 128. The property value is entered as text, not as presentation syntax: do not add quotes, and `\DDD` escapes are not decoded in this field. On output the text is encoded as UTF-8 and the tool quotes it, escaping `"`, `\` and every byte outside printable ASCII as `\DDD` (so `ÿ` becomes `\195\191`); an arbitrary non-UTF-8 byte sequence cannot be entered directly. The text is kept as typed — an unknown tag's value keeps its leading and trailing spaces or tabs (RFC 8659 §4.1 treats the value as binary); only `issue` and `issuewild` drop them, because they are meaningless `*WSP` in their grammar, and `iodef` rejects them because its value is a URL. `issue` and `issuewild` follow the RFC 8659 §4.2 issue-value grammar: an empty value or `;` for no issuance, or an issuer domain (LDH labels of at most 63 characters, 253 overall) with optional `;tag=value` parameters — parameter tags may contain hyphens, values may be empty, and space or tab is allowed around `;` and `=`. `iodef` accepts mailto, http, or https values. The owner is written in RFC 1035 §5.1 presentation syntax: any label octet is legal (RFC 2181 §11), so besides letters, digits, `-` and `_` you can write `\.`, `\032` or `\255` for a dot, a space or any other octet by decimal value; the master-file characters `" $ ( ) . ; @ \` and space, control or non-ASCII octets must be escaped that way, and the tool re-encodes the name canonically. Labels are 1–63 octets and the name at most 255 octets on the wire. `*` is an ordinary label character; the owner is a DNS wildcard owner only when its leftmost label is exactly `*` (RFC 4592 §2.1.1). `xn--` labels are passed through without IDNA validation. A `*.example.com` owner is only DNS wildcard syntax (RFC 4592) and is a separate concept from a `*.example.com` certificate: for a `*.X` certificate, CAA lookup starts at X. If the Relevant CAA RRset contains any `issuewild` properties, `issuewild` takes precedence and `issue` is ignored for wildcard issuance; otherwise `issue` applies (RFC 8659 §3, §4.3). TTL is 0–2147483647 (RFC 2181). Values are capped at 16,000 characters for this local tool. This is syntax assistance only: it neither checks live DNS nor determines whether a CA will authorize issuance.