Why CAA exists
Anyone who can convince a CA that they control a domain can historically get a certificate. CAA (RFC 8659) lets you publish, in DNS, a list of CAs you actually use — Let’s Encrypt, Google Trust Services, DigiCert, and so on. CAs are required to check CAA before issuing. If issuance fails with a CAA error, this lookup shows whether the zone forbids that CA.
A typical record looks like 0 issue "letsencrypt.org". issuewild covers wildcard certs. iodef can point at a mailto or URL for reports. Empty or missing CAA means any CA may issue. That is still common; publishing CAA is a hardening step, not a requirement for HTTPS.