Comment by thenewnewguy

Clients cannot because the current CAA spec only requires that it be checked/valid at issuance time.

Thus, as a client, it is impossible to distinguish between:

1) A certificate that was issued in violation of a CAA record

2) A certificate that was issued correctly for a website that later changed their CAA record