DV certificate (cheapest, most common one) does require only proof of control over the domain. So dnsdelegation.io can just request certificate for the domain

DV certificate (cheapest, most common one) does require only proof of control over the domain. So dnsdelegation.io can just request certificate for the domain you've delegated via cname from any CA.