ACME DNS-01 Challenge doesn't need a public resolvable and reachable host, it just sets a temporary DNS record to verify.