It's the DNS-01 challenge[1]. This reduces the challenge to using some DNS provider with an API supported by a client[2] / [3], as well as the server needing to be able to reach the LE-API. We use this with the CNAME delegation into an irrelevant zone everywhere to get wildcard certificates for our LBs ( meaning: the _acme_challenge.example.com record is just a CNAME for _acme_challenge.dont.ever.use.this.example.com, and the servers just have credentials to modify records in the zone <dont.ever.use.this.example.com>)

1: https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-...

3: https://github.com/acmesh-official/acme.sh/wiki/dnsapi