Comment by zeeZ

Only needs to be public for the challenge though. We use split DNS with an external server that has an empty zone. Internal clients are limited to setting their respective _acme-challenge.subdomain TXT record and delete it afterwards.