I'm not sure it "protects" anything, per se - more of a formalisation that CAs should verify that the domain owner is the one making the request. I doubt brows

I'm not sure it "protects" anything, per se - more of a formalisation that CAs should verify that the domain owner is the one making the request. I doubt browsers will ever check CAA, since it's even easier to tamper with than OCSP (since the majority of DNS requests are still over plain text).