In short, no.
And here it is why.
1. Do not use made up names
Whatever you do on the Internet, when you really need fake/obfuscated name, do not just invent some and hope that it will be fine in the future for everyone. By that reasoning,
.MAIL has become a TLD that will never exist because it has been abused by so many documentations.
RFC 2606 provides you with a set of correct values for such a case, basically,
2. Empty CAA records
But using "fake" names is not even necessary for
The RFC 6844 gives this example:
For example, the following CAA record set requests that no
certificates be issued for the domain 'nocerts.example.com' by any
nocerts.example.com CAA 0 issue ";"
So just do that, do not invent a fake name.
Is your domain DNSSEC-enabled?
CAA records can be spoofed or dropped
4. Use of
CAA records: issuance time vs use time
"this is not verified or enforced by browsers."
They do not need to. Per CAB Forum requirements (section 188.8.131.52 of https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.6.2.pdf), nowadays all CAs are required to check for CAA records at certificate issuance time.
This is when it matters because the certificate will be valid for let us say 1 year; and during this timeframe the DNS
CAA record can be changed to many things, so at use (connect) time the browser may get a completely different answer than the one at certificate issuance time.
And Crypt32 said it in the comment, as written in the requirements: "This stipulation does not prevent the CA from checking CAA records at any other time."
But feature wise, you are probably more thinking about
DANE and its
TLSA records, see RFC 6698 and 7671.
They would provide to clients the insurance, at connect time, for any given service, that the server indeed should be using either the certificate or public key exposed in the
TLSA records or a certificate signed by a specific authority whose certificate is in a
- you need a DNSSEC enabled zone for them to be useful, otherwise trivial downgrade attacks are possible, and
- clients need to use these records, otherwise they can not enforce the rules you put in place; unfortunately for now for browsers it is at most an add-on and certainly not a base feature.