CAA record
A CAA record (Certification Authority Authorization) is a DNS record that names which certificate authorities may issue certificates for a domain. CAs are required to check it before issuing.
example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 iodef "mailto:security@example.com"
What it does and does not do
It narrows who can issue. If your certificates come from Let's Encrypt, a CAA record naming Let's Encrypt means any other compliant CA will refuse a request for your domain — including a request from somebody who has temporarily compromised your DNS but not noticed the CAA record.
It is not a defence against an attacker who controls your DNS, because they can remove the record. It is a defence against mistakes, against a CA being tricked, and against the long tail of CAs you have never heard of.
The trap
No CAA record means any CA may issue. That is the default, and it is what most domains have.
The second trap is forgetting it exists. A CAA record naming one CA will block your own colleague when they try to get a certificate from another one, and the error surfaces at the CA rather than in your DNS — so it looks like the CA is broken.
Related
Check a domain's current records with the DNS lookup tool. IT Watch alerts on DNS record changes, including a CAA record appearing or disappearing.
See also: Certificate Transparency.