I assume you have a split-horizon dns setup (internal lan vs global public internet)?
It's easiest if this is viewable to all. The ACME Server needs the NS + A records to make port 53 DNS queries. Your client (Certbot) needs the A record to make the HTTP queries to the acme-dns restful API server. IIRC, it's possible to configure the client to access it under a different name (i don't think acme-dns does hostname checking), but you're highly likely to encounter weird setup issues if you do.