A CAA record is a DNS record that says which certificate authorities can issue TLS certificates for your domain. How CAA records work
Enter a domain or subdomain to see the CAA records that apply to it. It's checked the same way a CA checks it: if the name has no records of its own the parent domains are tried, CNAMEs are followed, and DNS failures that would stop a certificate being issued are reported.
Getting a "CAA record prevents issuance" error? Start here.