Domain Control module doesn't work with Email or DNS
The Domain Control module only affects adding websites, not Email or DNS. This appears to be a security concern, not just a feature request, as it allows clients to hijack email for other domains, and in some configurations DNS.
I'm really not terribly concerned about a client adding a website for a domain they don't own. As DNS records for that domain won't usually point the ispconfig weberver with that 'hijacked' domain, about the worst thing that can happen is that one client hijacks a domain which another client was intending to host on the same server, before that other client has it setup. Easy enough to resolve with administrator intervention.
What I was concerned about when I enabled the Domain Control module is that clients not be able to interfere with/hijack email for domains they didn't own, like ebay, paypal, gmail, etc., and somewhat concerned about DNS (our configuration doesn't have authoritative nameservers shared with recusive resolvers, but there are surely plenty enough shops to be found that would do precisely that). So I tested this:
As the Client I added bogus domains to dns under my control, and also added 'gmail.com' as an email domain (I added my own gmail address and tested sending from another hosted email account, and indeed email to the real gmail.com was captured).
So in the current state (in 3.1) unless I've missed a setting somewhere, if you want a client to be able to manage their own email mailboxes/settings for their domain, you must give them access to the Email module, and that allows them to take over email for any domain not already hosted on the ispconfig installation. And same with DNS.