@ for the root of the domain, or the subdomain on its own (shop for shop.example.com).issue, "Only allow wildcards" is issuewild, and "Send violation reports to URL" is iodef.letsencrypt.org (values for each CA). Leave out the quotes.Repeat for each CA you use. Once saved, the records show up in the list in the usual 0 issue "letsencrypt.org" form.
CAA records can't be proxied, so there's no orange cloud to worry about.
If Universal SSL is on (it is by default), Cloudflare adds extra CAA records for the CAs it uses as soon as you create any CAA record yourself. That way your own records don't stop Cloudflare renewing its edge certificates.
You won't see these in the dashboard, but they're there in DNS and this tester will show them. At the time of writing they include:
0 issue "letsencrypt.org" 0 issue "pki.goog" 0 issue "sectigo.com" 0 issue "ssl.com"
Cloudflare changes this list from time to time. Two things follow from it:
issue records with no parameters. If you've restricted a CA to your account with accounturi or to one validation method with validationmethods, the plain record for that CA undoes it. More on accounturi.Advanced certificates bought through Cloudflare don't get these automatic records, so add the CA for those yourself.
A subdomain with no CAA records of its own uses the parent's. If you add records to the root of the domain, every subdomain on Cloudflare is now limited to those CAs, plus the ones Cloudflare adds.
If a subdomain is a CNAME to another service, the lookup follows it, and CAA records on the target apply instead. Test the exact name to see which records are being used.
Changes on Cloudflare usually show up within a minute or two. Test the domain below, or run:
dig CAA example.com +short
Expect to see Cloudflare's records listed alongside your own.