Per https://github.com/letsencrypt/boulder/blob/master/bdns/dns.go#L260 https://github.com/letsencrypt/boulder/blob/master/bdns/dns.... it seems they round robi

Per https://github.com/letsencrypt/boulder/blob/master/bdns/dns.go#L260 https://github.com/letsencrypt/boulder/blob/master/bdns/dns.... it seems they round robin. But they are aware of the issue in the spec: https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.html#rfc.section.10.2 https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.htm... - “Querying the DNS from multiple vantage points to address local attackers” is a mentioned mitigation that a server could implement. Seems like a reasonable basis for a pull request.