Every .dk domain whose CAA record carries letsencrypt.org; validationmethods=dns-01: for an issue/issuewild tag, the certificate authorities allowed to issue TLS certificates for the domain; for iodef, where CAs report problems. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.