What CAA records do
A CAA record, short for Certification Authority Authorization, is a DNS record that names the certificate authorities you allow to issue SSL and TLS certificates for your domain. It lives alongside your other DNS records and is read by certificate authorities before they hand out a certificate. When a CA sees a CAA record that does not list its own name, it refuses to issue, so the record acts as a public allowlist for who may certify your domain.
The risk this guards against is certificate misissuance. Without a CAA record, every publicly trusted authority is fair game, which means a mistake at any one of them, or an attacker who tricks one of them, can produce a valid certificate for your domain. By listing only the authorities you actually use, you shrink that surface to the handful of CAs you trust, and a request to anyone else is turned away at the source.
The issue and issuewild tags
A CAA record carries a property tag that decides what it controls. The issue tag lists authorities allowed to issue ordinary certificates for the hostname, while issuewild lists authorities allowed to issue wildcard certificates that cover all of your subdomains. Keeping these separate lets you permit a CA for single hosts while holding wildcard certificates to a stricter set, since a wildcard is broader and worth guarding more carefully. A third tag, iodef, gives an address where a CA can report an attempt to issue against your policy.
A typical record looks like example.com. CAA 0 issue "letsencrypt.org", which tells every authority except Let's Encrypt to refuse. Once you have set the right authorities, run a full scan with the DNS Security Checker to review your other DNS protections in one place.