> For DV, if you can successfully MitM every connection to a destination, then you _do_ own the domain.
That's a policy, not an inherent consequence of DV certs.
If every verification method other than DNS was shut off, it would still be DV, but with care it could be immune to MitM. I'm not advocating for that, but it's an option.
It wouldn't be immune to MitM on DNS - unless DNSSEC were to become mandatory.
Don't focus too hard on the current method. Just work with me and imagine a value that comes direct from the registry and there's some kind of secure link, maybe DNSSEC maybe not.