Certbot w/acme-dns manual w/dns auth

That's exactly what acme-dns does. That's the point of running it.

@RPD, I'm not sure I'm following your setup. Here's how I have acme-dns set up, using Cloudflare for the rest of my DNS. I have it running on acme.mydomain.tld. I have the following records at Cloudflare:

acme.mydomain.tld NS ns.acme.mydomain.tld
ns.acme.mydomain.tld A (my IP)
_acme-challenge.mydomain.tld CNAME random.acme.mydomain.tld (repeated for each hostname and domain I'm using)

I think you're expecting that the A record above shouldn't be needed at your DNS host. I see the logic in that, but I don't know how else the Internet would know how to find the IP address for ns.acme. to properly direct the rest of the queries.

Edit: If it helps, here's a thread I posted last year that helped me understand how it works: