DV certificate (cheapest, most common one) does require only proof of control over the domain.

So dnsdelegation.io can just request certificate for the domain you've delegated via cname from any CA.