301 cross domain redirects should not be followed

That might have been your intention but it doesn't match up to the semantics of domain validation under the guidelines of the baseline requirements. You delegated control to a third party of what is returned to HTTP GET requests to your domain and that's a valid way for the third party to demonstrate control of the domain.

In the near future when remaining policy issues are addressed you'll be able to use ACME-CAA to add a CAA policy in your domain's DNS zone to explicitly only allow TLS-ALPN-01 or DNS-01 challenges for authorizing issuance for your domain, not HTTP-01. That would allow you to continue to redirect your domain without allowing the third party to issue a certificate for your domain.