What is CAA

CAA is a DNS record that names which certification authorities may issue certificates for the domain. A public CA has to check it before it issues.

certs.example.com CAA 0 issue "ca1.example.net"

A relying party must not use CAA as part of certificate validation. The line above is an example in RFC 8659. issue ";" is how that RFC shows a name that grants no issuer.