CAA DNS records restrict who can issue certificates for a domain

https://keytalk.com/news/public-key-infrastructure-pki-what-how-and-why-its-so-important

CAA DNS records restrict who can issue certificates for a domain, reducing misissuance risk and strengthening domain owners’ control in PKI.