Hi,
Great plugin! :) Any chance that I can return the plain text record as well? In addition to the parsed object. I'd like to use an option or something to acces for example string:

0 issuewild "letsencrypt.org" 0 issue "letsencrypt.org" 0 iodef "mailto:[email protected]"

in addition to the object.

I'm noticing some odd behaviour with the handling of CAA records for alias targets where only one of the records is returned instead of all of the records.

Given this hypothetical configuration:

alpha.domain.example
CNAME: bravo.example
CAA: (unset)

bravo.example
A: 1.2.3.4
CAA: issue "amazon.com"
CAA: issue "comodoca.com"
CAA: issue "letsencrypt.org"

Executing the following:

await caa.matches('alpha.domain.example', 'letsencrypt.org');

The library returns false, instead of true. Debugging a bit, executing:

await caa('alpha.domain.example');

returns [{flags: 0, tag: 'issue', value: 'amazon.com', issuerCritical: false}].

I believe this section of code (https://github.com/silverwind/caa/blob/master/index.js#L126-L130) returns too eagerly and just returns after one match instead of filtering the list to all matches.

From rfc8659:

account.example.com   CAA 0 issue "ca1.example.net; account=230123"

There is some interesting behavior of how CNAME and CAA records can interact that I do not think is correctly handled in this library. This is made more confusing because this relationship was changed in an errata: https://www.rfc-editor.org/errata/eid5065

The relevant bit of that errata to this issue is:

  Thus, when a search at node X returns a CNAME record, the CA will
  follow the CNAME record chain to its target. If the target label 
  contains a CAA record, it is returned.

  Otherwise, the CA continues the search at the parent of node X. <----- This line

Given this hypothetical DNS setup:

hosting-provider.com
A: 1.2.3.4
CAA: (unset)

client-domain.com
A: 9.8.7.6
CAA: issue "pki.goog"

www.client-domain.com
CNAME: hosting-provider.com

If I use this library like this:

await caa.matches('www.client-domain.com', 'letsencrypt.org');

this library will return true - but it really should be returning false (Lets Encrypt, for example, will not issue a certificate for www.client-domain.com when the DNS setup is like this.)

What this library does:

1. DNS lookup www.client-domain.com
2. Follow CNAME to hosting-provider.com
3. DNS CAA lookup of hosting-provider.com
4. Sees empty results, uses those results for the overall results for www.client-domain.com
5. Sees caas.length is empty, and returns true in caa.matches()

What I think the correct behavior is:

1. DNS lookup www.client-domain.com
2. Follow CNAME to hosting-provider.com
3. DNS CAA lookup of hosting-provider.com
4. Sees empty results, so return to parent node of original domain
5. DNS CAA lookup of client-domain.com
6. Sees issue "pki.goog" as CAA record
7. In caa.matches() compares pki.goog against lets-encrypt.org and returns false.