What is / Full version
CAA
CAA tells a public CA which issuers may mint a certificate for the name. It is not a check a TLS client runs on a presented certificate.
Before issuance
Before issuing a certificate, a compliant CA must check for a Relevant RRset. If that set exists, the CA must not issue unless the request is consistent with it, or an exception in the CA's CP or CPS applies.
Relying Parties must not use CAA records as part of certificate validation. A certificate that does not match today's CAA may still have matched the CAA that was published when it was issued.
issue and issuewild
RFC 8659's example that authorises two CAs is certs.example.com CAA 0 issue "ca1.example.net" and CAA 0 issue "ca2.example.org". issue ";" grants no issuer.
issuewild has the same syntax as issue but only for a wildcard name. If any issuewild is present for that wildcard request, every issue property is ignored for that request.