> There is a Caddy extension for doing DNS based validation, but that puts you back to needing a DNS provider with an API.

Yea, for clarity this is what i was describing. I use Porkbun's API and the Caddy instance isn't reachable from the internet, only local and over tailscale