Unless DNSSEC is used, email, DNS, and URL verification amount to almost nothing. I'd guess that there is at least one CA that is not using it and leaving the d

Unless DNSSEC is used, email, DNS, and URL verification amount to almost nothing. I'd guess that there is at least one CA that is not using it and leaving the door wide open. I'd also guess there are plenty of domains depending on CA validation that haven't enabled DNSSEC.