From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. email@example.com, firstname.lastname@example.org) or by sending on the designated email address on the domain name registration record (the information published on WHOIS).
Since many emails servers from non major email service providers do not encrypt and only few email providers even supports STARTTLS. Therefore, it is possible to intercept emails sent to these vulnerable email providers (how hard would this be?). Is domain validated certificate somewhat useless if the website's designated contact email address is hosted in less than secure email provider (e.g. self managed email servers in particular)?
What would prevent me from being issued a valid SSL certificate signed by a recognized CA for a domain I do not own by doing a passive/active MITM on an email service provider?
I'd assume that if you control the authoritative DNS, then you also control the Domain Validation by definition, so that's not realty a vulnerability. However, DNS caches is another matter, how could a CA make sure that its DNS entries comes from a legitimate source especially if the site owner don't make use of DNSSEC?