Are problems expected when a subdomain CNAME target has no CAA record?

CAA records "climb to the root".

See 3 of RFC 8659 "DNS Certification Authority Authorization (CAA) Resource Record" which has this pseudo algorithm:

      RelevantCAASet(domain):
        while domain is not ".":
          if CAA(domain) is not Empty:
            return CAA(domain)
          domain = Parent(domain)
        return Empty

So if www.example.com CAA returns empty result, the client (which is typically the CA) is expected to issue example.com CAA and then it stops there as the results won't be empty based on your example. There is no reason to continue anything at the name towards which the CNAME points to, things stay with the original domain name.

This is spelled out in details at 7 of that document:

This document obsoletes [RFC6844]. The most important change is to the "Certification Authority Processing" section (now called "Relevant Resource Record Set" (Section 3), as noted below). [RFC6844] specified an algorithm that performed DNS tree-climbing not only on the FQDN being processed but also on all CNAMEs and DNAMEs encountered along the way. This made the processing algorithm very inefficient when used on FQDNs that utilize many CNAMEs and would have made it difficult for hosting providers to set CAA policies on their own FQDNs without setting potentially unwanted CAA policies on their customers' FQDNs. This document specifies a simplified processing algorithm that only performs tree-climbing on the FQDN being processed, and it leaves the processing of CNAMEs and DNAMEs up to the CA's recursive resolver.

As for:

When the admins of ghs.googlehosted.com delete their CAA entry at one point,

CAA records are checked only at certificate issuance, by the certificate authority, and never after.

Other than that, for any cases, not just CAA, when you have CNAME pointing to external resources not under your control you indeed kind of leave some control of your DNS tree to those resources so it can have side effects. Which boils down to monitoring what those are doing and removing any records you don't need to avoid dangling records that can be vulnerabilities yielding to a full blown takeover.

Solved by user137710 (1,738 )
Aug 31, 2021 at 16:19