Everyone in this thread knows what a CAA record is. That’s not the point, although I doubt most people on this thread knew that the use of DNSSEC is strongly r

Everyone in this thread knows what a CAA record is. That’s not the point, although I doubt most people on this thread knew that the use of DNSSEC is strongly recommended for issuers of certificates. I’m pretty sure Lets Encrypt doesn’t operationally depend on DNSSEC, but if they’re issuing certificates to a zone with DNSSEC-signed CAA resource records, that’s irrefutable proof of the intent of the zone operator, something that Lets Encrypt and other issuers of certificates should probably pay attention to, regardless of the personal feelings of their engineers about any particular standard. Without DNSSEC, there’s no way to know if the CAA records have been tampered with when using something like ACME.