Well google.as has a CAA record of 24 hours now. I assume it had one before.

Therefore either

1) Letsencrypt ignore CAA records (unlikely)

2) The DNS hijackers removed the CAA record 12+ hours before doing their attack and google did not notice (I'd hope unlikely)

3) Letsencrypt querys did not return a cached CAA record because their resolvers had not been asked for it, so removing the CAA record a few minutes before hand worked.

> .com may be actively under attack please call this number on the old certificate, codeword banana-alpha-lima-lima-sigma

Do you seriously think this is an appropriate message to give to Aunt Irene?