I think you're right, however this is no different from how your average domain-verified certificate is issued (where you'd receive a confirmation mail to somet

I think you're right, however this is no different from how your average domain-verified certificate is issued (where you'd receive a confirmation mail to something like webmaster@example.com or serve a file given to you by the CA on a specific path). If an attacker manages to hijack your DNS, he could also modify your MX/A records and receive that mail/host the file. You could argue it's even slightly better, since with this solution, DNS is the only attack surface, whereas with email verification a vulnerable mail or web server would be enough. That is, if DNS is their only supported verification mechanism (which I don't think is true.)