DNSSEC could be used to protect against it, if TLS cert issuing policies were tightened by folks who mandate the minimum verification requirements for CAs, but

DNSSEC could be used to protect against it, if TLS cert issuing policies were tightened by folks who mandate the minimum verification requirements for CAs, but this is not currently done. (eg Let's Encrypt supports DNS verification as one mechanism currently, but it also supports plaintext HTTP which is vulnerable to BGP hijack)