Maybe somebody finds this useful:
https://ente.limmat.ch/ftp/pub/software/bash/letsencrypt/letsencrypt_acme_dns-01_challenge_hook
It is a first version of a dns hook script to use with bind and letsencrypt.sh to run in a GNU userland.
Because “new users are limited to three replies” (how stupid is that?), I answer the question of “whocares” here:
The script letsencrypt_acme_dns-01_challenge_hook uses dig to query all your nameservers with the published challenge. If you get the Error “None of the name server(s) answer the challenge correctly.” the challenge did not get published. Most probable reason is an error in the permission set up. The result of nsupdate is printed at the end of the line starting with “+ Updating DNS”. If you see “refused” you need to check your named.conf.local and verify the grant statement within the zone definition of the domain you are working on.