Comment by grishka

CAs themselves already trust DNS to verify your domain.