CAA record
Which certificate authorities may issue for this domain. A DNS policy, not a certificate.
CAA lets a domain list which CAs are authorised to issue certificates for it. CAs are required to check it before issue. The usual tags are issue, issuewild, and iodef.
CAA is not a substitute for monitoring what was actually issued. It does nothing to a certificate that already exists. A missing CAA means any CA may issue.
See also: DNS, Transport Layer Security (TLS).
Fact source: IETF RFC 8659, CAA.