If you’re in the middle; this is the most trivial thing in the world to block; in fact the CAA dns record is so limited in what it protects against that I’m genuinely confused as to why it exists.

Maybe with DoH it’s better. But that’s more https to make https not suck.