Comment by arccy

Note that you can delegate the _acme-challenge subdomain to a validation-specific server or zone, so a different server that supports automation if you can't / don't want to change your main DNS provider.

https://letsencrypt.org/docs/challenge-types/#:~:text=This%2...