The same way they are intercepting the jabber port they can intercept any other port for the HTTP ACME challenge. No need to get involved at the name server level.