Yes, this is called domain validation and most CAs operate like this for regular non-EV certificates. Sometimes it's an email, sometimes it's a file with certai

Yes, this is called domain validation and most CAs operate like this for regular non-EV certificates. Sometimes it's an email, sometimes it's a file with certain content at a certain URL, sometimes it's a DNS record. But beyond that, no further validation is required for regular certificates.