CAA record
CAAA CAA record states which certificate authorities are allowed to issue certificates for your domain.
What a CAA record does
A CAA record, defined in RFC 8659, names a certificate authority permitted to issue certificates for a domain. Authorities are required to check CAA records before issuing.
Publishing no CAA record means any authority may issue. CAA is a restriction, so its absence is permissive rather than restrictive.
Tags and inheritance
The "issue" tag authorises normal certificates and "issuewild" authorises wildcards. The "iodef" tag gives a contact address for reporting requests that were refused.
Lookups walk up the domain tree: an authority checking sub.example.com that finds nothing there will check example.com next. A record at the apex therefore governs subdomains unless one overrides it.
example.com CAA 0 issue "ca-one.example"
What it does and does not protect
CAA reduces the risk of an unauthorised certificate being issued by an authority you do not use. It is a control on issuance, not on validation.
It has no effect on certificates that already exist, and it does not stop anyone who can pass an authority's domain validation for an authority you have authorised.