It can be anything! An apex, subdomain, or even a URL.

Results forauthdns.ripe.net

Name	TTL	Value
authdns.ripe.net	86400	0 issue "letsencrypt.org ;validationmethods=dns-01"
authdns.ripe.net	86400	0 issuewild ";"

CAA