[sigio]

A CAA dns record will most likely prevent tbat, just set it to your preferred CA tgat doesn't do mail-based validation.

[kevincox]

This doesn't help if your preferred CA does mail-based validation. The attacker can just use the same CA that you do.