A CAA record tells certificate authorities which of them are allowed to issue certificates for your domain. Cheap to add, blocks a class of mis-issuance attacks.
RFC 8659 — DNS Certification Authority Authorization (CAA) Resource Record
RFC 8657 — CAA Record Extensions for Account URI and ACME Method Binding