No CAA record on the apex swampai.world, so certificate issuance for it is unrestricted

CAA records are resolved by climbing the DNS tree from the queried name until a CAA resource record set is found, so the policy that governs swampai.world is whatever is published at swampai.world, or failing that at the parent world, and not what is published at www.swampai.world. www carries CAA naming four authorities (globalsign.com, letsencrypt.org, sectigo.com, pki.goog). The apex carries none, and neither does the parent, so for the apex the effective policy is that every publicly trusted certificate authority is free to issue. That matters because the apex is not a dormant name: it answers TLS itself with a certificate whose only subject alternative name is swampai.world, and it redirects to www over HTTPS. The operator plainly intends to restrict who may issue, since they published that intent on www, but the restriction does not reach the name a user types. With HSTS at max-age=63072000 on the apex, the protocol downgrade path is closed, which leaves a mis-issued certificate as one of the few remaining ways to intercept traffic that browsers would accept. CAA does not stop mis-issuance on its own, it narrows the set of authorities who could cause it to a set the operator names.