There is a way to avoid this issue: Let&#x27;s Encrypt should disallow subdomain registrations unless a TXT record is present for the parent domain. For example, if I wanted to get a certificate for bar.foo.example.com there would need to be a Let&#x27;s Encrypt TXT record for foo.example.com.<p>Although it&#x27;s not their responsibility, they can take steps to mitigate it.