I'm not sure if you have used Google Apps before, but from memory it has DNS and website verification, so I can only assume it'd be vulnerable to this sort of attack.
Let's face it, being able to serve content on a website at all is enough to prove you own it these days.