Every CA must check CAA before issuing. If the record lists only letsencrypt.org, any other CA refuses the request. Without a CAA record, any CA may issue.
CAA is looked up by climbing the name tree: for cloud.example.com the record at example.com applies unless a more specific one exists. issuewild controls wildcard certificates separately, and iodef sets a contact for rejected requests.
Typical problem: a team switches certificate provider, or a hosting platform requests certificates on your behalf, and issuance fails with CAA record prevents issuance.
Example
example.com. 3600 IN CAA 0 issue "letsencrypt.org"