> It seems that lexicon is handy to use dns-01 instead of DNS aliasing. Say I own example.com, but because it lives on a DNS server that does not have an API,

> It seems that lexicon is handy to use dns-01 instead of DNS aliasing. Say I own example.com, but because it lives on a DNS server that does not have an API, or changes to the company's domain need to go through change control, I cannot easily change it. But I want an ACME/LE cert for foo.example.com, which could be an internal-only service so http-01 is not available. So I can set up a CNAME/alias at _acme-challenge.foo.example.com and point it to (e.g.) foo.example.org. Now I also own example.org, but because it's not the 'main' domain the controls on it are less onerous. So when I request "foo.example.com", it finds the CNAME and heads over to "foo.example.org", where I've update the ACME nonce dynamically. The CNAME setup is a one-time thing, and can go through the 'regular' steps initially, and can then just be left alone. Or, instead of a entire new domain (example.org), I can delegate things to a sub-domain (dnsauth.example.com) as well.