diff -r 4adb989bc93e sys/src/cmd/ndb/dblookup.c
--- a/sys/src/cmd/ndb/dblookup.c	Tue Nov 03 20:47:14 2020 +0100
+++ b/sys/src/cmd/ndb/dblookup.c	Sun Nov 29 16:42:47 2020 +0100
@@ -40,7 +40,7 @@
 static RR*	srvrr(Ndbtuple*, Ndbtuple*);
 static RR*	txtrr(Ndbtuple*, Ndbtuple*);
 
-static int	implemented[Tall] =
+static int	implemented[Tcaa] =
 {
 	[Ta]		1,
 	[Taaaa]		1,
@@ -118,7 +118,7 @@
 	rp = nil;
 
 	if(type == Tall){
-		for (type = Ta; type < Tall; type++)
+		for (type = Ta; type < Tcaa; type++)
 			if(implemented[type])
 				rrcat(&rp, dblookup(name, class, type, auth, ttl));
 
diff -r 4adb989bc93e sys/src/cmd/ndb/dn.c
--- a/sys/src/cmd/ndb/dn.c	Tue Nov 03 20:47:14 2020 +0100
+++ b/sys/src/cmd/ndb/dn.c	Sun Nov 29 16:42:47 2020 +0100
@@ -97,6 +97,7 @@
 [Tmailb]	"mailb",
 [Tmaila]	"maila",
 [Tall]		"all",
+[Tcaa]		"caa",
 		0,
 };
 
@@ -1042,7 +1043,7 @@
 {
 	int i;
 
-	for(i = 0; i <= Tall; i++)
+	for(i = 0; i <= Tcaa; i++)
 		if(rrtname[i] && strcmp(rrtname[i], atype) == 0)
 			return i;
 
@@ -1061,7 +1062,7 @@
 int
 rrsupported(int type)
 {
-	if(type < 0 || type >Tall)
+	if(type < 0 || type >Tcaa)
 		return 0;
 	return rrtname[type] != nil;
 }
@@ -1891,7 +1892,7 @@
 	char *t;
 
 	t = nil;
-	if(type >= 0 && type <= Tall)
+	if(type >= 0 && type <= Tcaa)
 		t = rrtname[type];
 	if(t==nil){
 		snprint(buf, len, "%d", type);
diff -r 4adb989bc93e sys/src/cmd/ndb/dns.h
--- a/sys/src/cmd/ndb/dns.h	Tue Nov 03 20:47:14 2020 +0100
+++ b/sys/src/cmd/ndb/dns.h	Sun Nov 29 16:42:47 2020 +0100
@@ -71,6 +71,7 @@
 	Tmailb=	253,	/* { Tmb, Tmg, Tmr } */
 	Tmaila= 254,	/* obsolete */
 	Tall=	255,	/* all records */
+	Tcaa=	257,	/* Certification authority restriction */
 
 	/* classes */
 	Csym=	0,	/* internal symbols */