Ownership verification is already done via DNS by existing CAs. If an attacker has full control over your DNS, he can already change the DNS records and trick a CA into delivering him a genuine certificate.
This isn't really a MITM attack.
This isn't really a MITM attack.
Shouldn't this be "over the CAs DNS resolver"?
/edit
well I guess if the attacker has control over your dns server, ofcours, but another vector is to spoof as the CAs resolver when the CA does a lookup for your domain.
The ones i've used (godaddy, startssl, namecheap/ssls.com rapidssl/positivessl) all wanted email verification iirc.
EDIT: of course that's equivalent to verifying the MX. Never mind!
* DNS: you need to add a specific record to your DNS zone * File: you need to add a specific file to the root of a HTTP server listening on the domain name * Email: they send an email to admin@ on the domain
All three are pretty much ways to check that you are the person in control of the associated DNS.