As noted above, DNS forgery attacks against the ACME server can
  result in the server making incorrect decisions about domain control
  and thus mis-issuing certificates.  Servers SHOULD perform DNS
  queries over TCP, which provides better resistance to some forgery
  attacks than DNS over UDP.
    
    An ACME-based CA will often need to make DNS queries, e.g., to [1]
  validate control of DNS names.  Because the security of such
  validations ultimately depends on the authenticity of DNS data, every
  possible precaution should be taken to secure DNS queries done by the
  CA. Therefore, it is RECOMMENDED that ACME-based CAs make all DNS
  queries via DNSSEC-validating stub or recursive resolvers.  This
  provides additional protection to domains that choose to make use of
  DNSSEC.
  
  An ACME-based CA must only use a resolver if it trusts the resolver
  and every component of the network route by which it is accessed.
  Therefore, it is RECOMMENDED that ACME-based CAs operate their own
  DNSSEC-validating resolvers within their trusted network and use
  these resolvers both for CAA record lookups and all record lookups in
  furtherance of a challenge scheme (A, AAAA, TXT, etc.).