> I use the acme dns-1 challenge on my public domain.

See also perhaps DNS aliasing in case you are not able to dynamically update your 'primary' domain, but can update a secondary or sub-domain:

* https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...

So if "example.com" is control by Corporate IT, and they don't want 'random' folks fiddling with it, then you can create a "dnsauth.example.com" and point the dns-1 challenge record from "…foo.example.com" to "foo.dnsauth.example.com" (or a completely different domain, like "…example.net").

There are DNS servers written strictly focused on this use case:

* https://github.com/acme-dns/acme-dns

Also code that handles a bunch of DNS provider APIs so you don't have to roll your own for ACME client hooks:

* https://github.com/dns-lexicon/dns-lexicon