I think you are half correct. The gateway has nothing to do with verifying the file during a DNS challenge. However, the IP of the machine requesting the cert IS saved with that cert information and made public. Let's encrypt will even warn you during the verification process.

The IP of the machine requesting the certificate is recorded by Let's Encrypt, but it is not (ordinarily) made public and certainly isn't (as you can see by inspecting it for yourself) saved with the certificate information.

ISRG is required to keep enough information about the issuances they make to allow them to usefully diagnose problems after the fact. Ideally when we discover a problem it will be possible for the issuer to go back and figure out which (if any) previously issued certificates were affected so that these certificates can be revoked if appropriate.

But although they had at one point planned to publish more of this information, they do not in fact do this routinely.

Yeah, I was referring to the certbot warning of "logging" the IP publicly. But I guess that policy never actually came to fruition. Thanks for the clarification!

The host names wouldn't even need to resolve at all outside of the local network. Only the challenge subdomain _acme-challenge.foo.bar.org so certificate transparency will of course expose the existence of foo.bar.org but it wouldn't need to expose anything at all about those DNS records if you wanted to restrict them to only the local network.