If your DNS host supports it (Route53 does), you can set a wildcard CAA record with no valid issuers that will do what you want. Bare -> LE delegation WWW -> e

If your DNS host supports it (Route53 does), you can set a wildcard CAA record with no valid issuers that will do what you want. Bare -> LE delegation WWW -> explicit LE delegation * -> no delegations, and will override "bare" since resolution walks up the domain tree.