A CAA record restricts which certificate authority is allowed to issue an SSL certificate for a domain. Most domains never set one, but if a previous host added one that only names its own authority, a new host's certificate request can fail without any obvious error pointing at the cause.
It is one of a handful of things that can quietly break a domain move even after the DNS record itself looks correct, alongside a wrong TTL or a verification record left over from a different provider.
For the full list of things that cause a stuck "Verify" and how to check each one, see connect a domain you already own.