alt Hacker NewsClients cannot because the current CAA spec only requires that it be checked/valid at issuance time.
Thus, as a client, it is impossible to distinguish between:
1) A certificate that was issued in violation of a CAA record
2) A certificate that was issued correctly for a website that later changed their CAA record
There's also the basic problem that an attacker who can serve you a falsified A record for a domain can also serve you a falsified CAA record. This is why CAs are required to use "multiple perspectives" when validating domain ownership before issuing certs, whereas web clients generally don't have access to redundant infrastructure like that.