The CAA dns type indicates which CAs are allowed to sign for a domain.
If you’re in the middle; this is the most trivial thing in the world to block; in fact the CAA dns record is so limited in what it protects against that I’m genuinely confused as to why it exists.
Maybe with DoH it’s better. But that’s more https to make https not suck.
From the linked article.
> Use CAA records[0] to restrict which CAs can issue certificates for your site.
Disclaimer, I didn't know about them either. TIL.
For Google this is fixed by hard coding the SSL hashes into chrome, for the rest of us we rely on http headers; which of course are much more fungible.