Resources
What is a CAA record?
The CAA record says which certificate authority may issue certificates for your domain — and who to notify if somebody tries anyway.
Certificate authorities are required to check CAA before issuing. A domain without CAA permits every authority; a domain with CAA permits only those listed.
The iodef property adds a contact for reports of refused or attempted misissuance. It only helps if the address is monitored.
CAA is inherited down the tree: a record at the apex covers subdomains unless they publish their own.
Every CTPFDNS zone gets a CAA record with an iodef contact when it is created, not as an afterthought.