A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap.emea.contoso.local, with certificates signed by an internal CA. Can a CAA record on contoso.local enforce that only the official Contoso CA can sign a certificate for Contoso domains?
Using CAA DNS records for internal networks doesn't really make sense, especially when you're using a .local domain.
Simply put: The way CAA records work is that an issuing CA will check the CAA records of a domain through public DNS records but only if the issuing CA is told to do so.
Public CAS are required to do that. But a public certificate authority cannot issue to a .local domain anyway since domain control is not verifiable.
Someone who set up an internal CA however could still issue to your contoso.local domain since his CA would not have to be configured to check public CAA records.
Hope that helps!