Let's Encrypt now supports ACME-CAA: closing the DV loophole
>> Except, when this Domain Validation is performed, you don't have a certificate yet. That's why you're going through the process in the first place: to get a certificate. Which means that when the CA verifies that your domain is correctly hosting the challenge, it does so via ordinary, unencrypted HTTP... which can be trivially subject to man-in-the-middle attacks.<p>This is not completely true.<p>For HTTP challenge, yes its true. But for DNS Challenge its not.<p>DNS Challenge requires the provisioning of a special DNS Text record. Assuming you are using an API with your DNS provider this can happen over HTTPS. (Indeed I can confidently say it would <i>Have</i> to be over HTTPS, or similar.)