Thankfully, you're still allowed to not have any CAA record for a domain. While I agree that in general it's a good thing, for my setup, the additional security

Thankfully, you're still allowed to not have any CAA record for a domain. While I agree that in general it's a good thing, for my setup, the additional security it provides is not worth the hassle of upgrading PowerDNS past what comes with the OS (Debian 8 ships with 3.4.1, CAA requires 4.0.0). Generally, I notice that the pace of standards requiring newer versions of software than what's shipping with the latest OS releases is increasingly quicker these days. Like ALPN being required for HTTP/2 and not being supported by the latest stable version of Debian.