Read a domain's CAA records, and check the zone's nameservers against the registry's.
Two things that are usually looked at separately and are more useful together: the CAA records that say who may issue certificates for the domain, and whether the nameservers the zone answers with match the ones the registry delegates to.
A CAA record names the certificate authorities allowed to issue for your domain.
example.com. CAA 0 issue "letsencrypt.org"
With no CAA record, any public CA in the world may issue a certificate for your domain to anybody who can pass its validation. With one, a CA that is not listed is obliged to refuse — which turns a whole category of misissuance into something that cannot happen rather than something you find out about afterwards.
It is one DNS record and it is free. The reason to be careful is the other direction: add a CAA record listing one authority, forget that your CDN issues its own certificates through a different one, and the next renewal fails. That is the common way this bites, and it bites at renewal rather than when the record is added, which makes it hard to connect to the cause.
Two sets of nameservers exist for every domain and they are supposed to be identical:
When they disagree, the domain still works — resolvers use the registry's — but you have a zone somewhere that is authoritative for a domain nobody is looking at. Mismatches usually mean a half-finished migration: the DNS was moved to a new provider, the registry was updated, and the old zone was never deleted.
That old zone is a real risk. It keeps answering, and if the account holding it lapses or is taken over, whoever ends up with it has a signed, working zone for your domain waiting to be pointed back.
Public DNS for the CAA and NS records, and one RDAP query to the registry to find out what it delegates to. Nothing is sent, no account is needed, and the domain you type is not stored.