Before issuing, a CA must validate that the applicant controls the domain, typically by asking for a specific DNS record, a file on the web server, or a response to an email sent to a domain contact. It must also check the domain's CAA records and refuse if it is not listed there.
CAs rarely sign with their root key directly. The root is kept offline and signs intermediate certificates, which in turn sign customer certificates; that is the chain a server presents. Browser vendors and operating systems decide which roots they include, based on audits and on the rules of the CA/Browser Forum, and they have removed CAs that broke those rules.
Every publicly trusted certificate is recorded in Certificate Transparency logs, which are public and append-only. Domain owners can watch those logs to see every certificate issued for their names, including ones they did not ask for.