CAA plus DNSSEC also provides significant defense against some types of attacks on domain validation.