If you are going to have all the home stuff on a subdomain (int.example.com) would it work to delegate int.example.com to a DNS server running at home what has internet access, and could handle the ACME DNS challenges for machines on int.example.com?

If it does then you don't have to mess with your public DNS whenever you want to add or renew certificates for home machines.

I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service and so if I could use a local DNS server for the ACME challenges for the home network I could pick one that is friendly to automation.

Yes, you're describing a fundemental feature of DNS.

> I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service

I use Cloudflare for DNS and it is free to use the API.

> I use the form of hostname.int.example.com […]

Note that int is a valid TLD:

* https://en.wikipedia.org/wiki/.int

* https://datatracker.ietf.org/doc/html/rfc1591

He’s using it as a subdomain.

Which can still cause problems depending on your search domain setting and resolver client

I do the same thing and have never had a problem. Maybe I’ve just been lucky for 25+ years. Some hosts have a search path of “int.example.com, example.com”. Others are just “example.com”

Could you give an example? I'm curious, too.

If you generally had "search example.com" in you resolv.conf, and were in the habit of having "web01.dev" in places, behaviour may have changed if you were happen to be on a machine that had the "search" line missing (or something else).

> He’s using it as a subdomain.

Lots of folks were using "dev" as a sub-domain which was fine until ICANN decide to give Google a TLD:

* https://en.wikipedia.org/wiki/.dev

So if you generally had "search example.com" in you resolv.conf, and were in the habit of having "web01.dev" in places, behaviour may have changed if you were suddenly on a machine that had the "search" line missing (or something else).

What you describe is a user and resolver configuration problem. There are 100's of TLDs and there's always a chance they will conflict with subdomains, either now or in the future as new TLDs are created. I've been using both "int" and "dev" as subdomains since at least 2000 and never had an issue.

> What you describe is a user and resolver configuration problem.

That won't prevent me from getting a ticket saying "the network is down".

Okay, I guess the only solution is to always use FQDNs.

So? I don't see any issue.

I always use FQDNs for everything.