diff --git a/docs/CLI.md b/docs/CLI.md
index 7a40af5..ee57867 100644
--- a/docs/CLI.md
+++ b/docs/CLI.md
@@ -119,7 +119,7 @@ dnstm tunnel add -t my-tunnel \
 | `--kcp-window-size` | VayDNS: KCP window size (default: queue_size/2)                    |
 | `--queue-overflow`  | VayDNS: queue overflow strategy (`drop` or `block`)                |
 | `--log-level`       | VayDNS: server log level (debug, info, warning, error)             |
-| `--record-type`     | VayDNS: DNS record type (txt, cname, a, aaaa, mx, ns, srv)         |
+| `--record-type`     | VayDNS: DNS record type (txt, null, cname, a, aaaa, mx, ns, srv, caa)         |
 
 ### Tunnel Share Flags
 
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index d5de367..1e380e7 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -240,7 +240,7 @@ VayDNS with dnstt-compatible wire format:
 | `kcp_window_size` | int    | 0                                    | KCP window size (0 = queue_size/2, must be ≤ queue_size)                                                     |
 | `queue_overflow`  | string | `drop`                               | Queue overflow strategy: `drop` or `block`                                                                   |
 | `log_level`       | string | `info`                               | Server log level: `debug`, `info`, `warning`, `error`                                                        |
-| `record_type`     | string | `txt`                                | DNS record type: `txt`, `cname`, `a`, `aaaa`, `mx`, `ns`, `srv` (must be `txt` when dnstt_compat is enabled) |
+| `record_type`     | string | `txt`                                | DNS record type: `txt`, `null`, `cname`, `a`, `aaaa`, `mx`, `ns`, `srv`, `caa` (must be `txt` when dnstt_compat is enabled) |
 
 **Note:** VayDNS does not support the `shadowsocks` backend type.
 
diff --git a/internal/actions/tunnel.go b/internal/actions/tunnel.go
index 574a284..94f1dd4 100644
--- a/internal/actions/tunnel.go
+++ b/internal/actions/tunnel.go
@@ -375,9 +375,9 @@ func init() {
 			},
 			{
 				Name:        "record-type",
-				Label:       "VayDNS record type (txt, cname, a, aaaa, mx, ns, srv)",
+				Label:       "VayDNS record type (txt, null, cname, a, aaaa, mx, ns, srv, caa)",
 				Type:        InputTypeText,
-				Description: "DNS record type (txt, cname, a, aaaa, mx, ns, srv). Default: txt. Cannot use non-txt with --dnstt-compat",
+				Description: "DNS record type (txt, null, cname, a, aaaa, mx, ns, srv, caa). Default: txt. Cannot use non-txt with --dnstt-compat",
 				ShowIf: func(ctx *Context) bool {
 					return !ctx.IsInteractive && config.TransportType(ctx.GetString("transport")) == config.TransportVayDNS
 				},
diff --git a/internal/config/tunnel.go b/internal/config/tunnel.go
index 0020e79..32eee44 100644
--- a/internal/config/tunnel.go
+++ b/internal/config/tunnel.go
@@ -51,7 +51,7 @@ type VayDNSConfig struct {
 }
 
 // ValidVayDNSRecordTypes returns the valid record types for VayDNS.
-var ValidVayDNSRecordTypes = []string{"txt", "cname", "a", "aaaa", "mx", "ns", "srv"}
+var ValidVayDNSRecordTypes = []string{"txt", "null", "cname", "a", "aaaa", "mx", "ns", "srv", "caa"}
 
 // ResolvedVayDNSIdleTimeout returns the idle-timeout string for vaydns-server, applying defaults when empty.
 func (v *VayDNSConfig) ResolvedVayDNSIdleTimeout() string {
diff --git a/internal/config/validation.go b/internal/config/validation.go
index 7cb53ee..83eca77 100644
--- a/internal/config/validation.go
+++ b/internal/config/validation.go
@@ -211,7 +211,7 @@ func (c *Config) validateTunnels() error {
 					}
 				}
 				if !validRT {
-					return fmt.Errorf("tunnel '%s': vaydns.record_type must be one of: txt, cname, a, aaaa, mx, ns, srv", t.Tag)
+					return fmt.Errorf("tunnel '%s': vaydns.record_type must be one of: txt, null, cname, a, aaaa, mx, ns, srv, caa", t.Tag)
 				}
 				if t.VayDNS.DnsttCompat && t.VayDNS.RecordType != "txt" {
 					return fmt.Errorf("tunnel '%s': vaydns.record_type must be txt when dnstt_compat is enabled", t.Tag)
diff --git a/internal/handlers/tunnel_add.go b/internal/handlers/tunnel_add.go
index 650e21b..e1ebe00 100644
--- a/internal/handlers/tunnel_add.go
+++ b/internal/handlers/tunnel_add.go
@@ -297,6 +297,8 @@ func addTunnelInteractive(ctx *actions.Context, cfg *config.Config) error {
 				{Label: "SRV", Value: "srv"},
 				{Label: "A", Value: "a"},
 				{Label: "AAAA", Value: "aaaa"},
+				{Label: "NULL", Value: "null"},
+				{Label: "CAA", Value: "caa"},
 			}
 			rtValue, rtErr := tui.RunMenu(tui.MenuConfig{
 				Title:   "DNS Record Type",
@@ -425,7 +427,7 @@ func addTunnelNonInteractive(ctx *actions.Context, cfg *config.Config) error {
 				}
 			}
 			if !valid {
-				return fmt.Errorf("invalid --record-type '%s' (must be one of: txt, cname, a, aaaa, mx, ns, srv)", recordType)
+				return fmt.Errorf("invalid --record-type '%s' (must be one of: txt, null, cname, a, aaaa, mx, ns, srv, caa)", recordType)
 			}
 		}