Wait, doesn't the certbot DNS challenge query the nameservers of the domain being checked, not your local DNS resolver, otherwise my fast DNS challenges should fail?
But in my case my network is configured to always reach the in house DNS first, to keep latency low
[1] https://github.com/letsencrypt/boulder/blob/8167abd5e3c7a142...