[merb]

btw. you can use a different dns server than you're main dns server which exposes the api, via cname redirects/ns records.

https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

> Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server.

[necovek]

That's neat, I might do that to limit the damage a bit!