For what it’s worth, a quick scan seems to show “dig $TLD caa
” succeeds for all other TLDs.
The shell hack i used may have corner cases but it’s probably accurate.
I don’t know if any TLDs have CAA
records, but the queries don’t fail.
Edit:
I did a non-hacky scan.
Every TLD except .sr
succeeded.
No TLDs had CAA
records.