I’m a bit confused with the CAA records and Universal SSL…
I have the univeral SSL active on my domains, but no CAA records are being created by CF. I haven’t added any other CAA records myself. I was in the impression that they would be automatically created?
Unless it’s changed recently, Cloudflare only automatically creates CAA records if you create your own CAA records.
So, if you issue your own certificates for some reason, you could add CAA records for the CA(s) you use. Or if you don’t issue any certificates, you could add a CAAiodef record. Then Cloudflare would create the others in the background.