@tykling No, it's not a CNAME, you want a NS for situations like AWS/Route53

new zone: _acme-challenge.foo.com.

In the parent zone make an NS for:

_acme-challenge.foo.com.

This delegates requests to your new sub-zone. And give the server a key that can only modify records in that subzone.

(if you are using BIND and maybe others you don't need to do this, IIRC you can be more granular without needing to make an entirely new zone)