Let's Encrypt does validate that you own the domain, using certain "challenges" involving the web server, etc. Their technical overview explains how it works:

Let's Encrypt does validate that you own the domain, using certain "challenges" involving the web server, etc. Their technical overview explains how it works: https://letsencrypt.org/howitworks/technology/ https://letsencrypt.org/howitworks/technology/