Broadcasting internal IPs on public DNS records is also a suboptimal approach that leaks information to the public. Local devices should be routed over layer 2.

DNS challenge doesn't broadcast internal IPs. Certificate transparency does show up hostnames or wildcards though.