I use the lego[1] client for DNS verification and it works pretty well so far (more deets[2]).

[1]: https://github.com/xenolf/lego

[2]: https://disjoint.ca/til/2016/03/26/lets-encrypt-tls-certific...