Oof. Reportedly, if you got a certificate from SSL.com by putting “example[@]gmail.com” at _validation-contactemail.example.com, they would add gmail.com (!!!) to your verified domains.
A good reminder to use the CAA record, and to sign up for CT monitoring (e.g. Cert Spotter).