Hm, doesn't Caddy support wildcards without DNS auth? It seems that they work around this by generating a few random subdomains and verify those.
"This release introduces support for wildcard certificates, a new offering from Let's Encrypt. Getting a wildcard certificate requires enabling the DNS challenge. Fortunately, that is extremely simple with Caddy, and it works with over 20 different providers!"