[kuschku]

As it's a DNS server that only ever serves certificate validation requests, and doesn't need 100% uptime, a normal simple BIND or knot is good enough.

[namibj]

I'd expect it to be built in to certbot like serverauth.