Most CAs accept an email to an predetermined address at the domain, which validates that a DNS entry (MX record) on the domain points to a server controlled by the requester.

Many also offer the same thing as Let's Encrypt, which basically verifies if the A/AAAA record for the domain points to a server controlled by the requester.

What am I missing?