CAA records are only checked by the CA at the point of issuance, not by the client later. If they did, there are problems to consider:

1. A domain would have to keep the CAA records for a CA in place to keep using the certificates from that CA, but that means continuing to authorise new issuance too. Right now, I can remove the `letsencrypt.org` value to stop them from issuing new certificates for me, but I can keep using any certificates I have until they expire.

2. The client would need to have support for this new DNS RR type.

3. The client would need a secure way to query DNS, which is not widespread.