Spurious CAA SERVFAIL responses during finalize

The only difference in production from Monday to today is the Unbound 1.18 update yesterday: Potential networking / client changes on DNS Challenges - #28 by jcjones

As gurjit said, their DNS server had an EDNS compliance issue which was raised by our Unbound upgrade to 1.18. If the compliance tester is happy for your zone, it should be fine.