Automatically renew the certificate without control on domain DNS?

[MikeMcQ]

@y_chen

Does it mean IT support created a record for acme-challenge.puck.io instead of _acme-challenge.puck.io?

YES. To work as the dns challenge that name still must reflect what Lets Encrypt server will look at first