Comment by deepsun

I heard that Zendesk Security team force your _root_ domain to allow their SSL certificates to be issued, per CAA dna record.

I.e. you have domain support.example.com, CNAMEd to Zendesk, so you cannot add any other DNS record to it, but Zendesk should do it on their side. But they refuse, and force you to put CAA to your root domain example.com.