Does above CAA record applies for all sub domains of google.com?
All subdomains that do not specify
CAA records of their own.
See, for example, the example in section 3:
The following example is a DNS zone file (see [RFC1035]) that informs
CAs that certificates are not to be issued except by the holder of
the domain name 'ca.example.net' or an authorized agent thereof.
This policy applies to all subordinate domains under example.com.
. CAA 0 issue "ca.example.net"
And the lookup algorithm in section 4.
If, for example,
mail.google.com had its own
CAA record (it currently doesn't), that record would apply to requests for certificates for
Can any other CA (apart from "symantec.com") that supports CAA would issue certificate for mail.google.com ?
If their DNS queries are successful and they strictly follow the CAA policy, no. As it currently stands, few CAs implement CAA, and some consider CAA more what you'd call guidelines than actual rules, and flag certificates for extra scrutiny, but don't out and out reject issuance.
Regarding your specific example of
mail.google.com, any halfway competent CA has
google.com on its VIP list and flags requests for certificates, rejecting them outright or making doubly damn sure they're valid. It's very unlikely a random CA would misissue -- or issue at all -- a
google.com certificate unless their validation systems were compromised or people had guns to their heads.