WoSign is one of the other CAs offering this option.<p>It is unclear to me how TXT verification would have prevent this. The article indicates that the attackers created the subdomain and pointed it at a server they controlled; this means DNS was compromised and creating a TXT record wouldn&#x27;t have been a problem.<p>Domain owners which are worried about Let&#x27;s Encrypt can opt to create a CAA DNS record that limits CAs allowed to issue certificates to ones they trust.<p>CA&#x2F;B BR can be found here[1].<p>[1]: <a href="https:&#x2F;&#x2F;cabforum.org&#x2F;wp-content&#x2F;uploads&#x2F;Baseline_Requirements_V1_3_1.pdf" rel="nofollow">https:&#x2F;&#x2F;cabforum.org&#x2F;wp-content&#x2F;uploads&#x2F;Baseline_Requirement...</a>