Every .dk domain whose CAA record carries letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/3452143386: for an issue/issuewild tag, the certificate authorities allowed to issue TLS certificates for the domain; for iodef, where CAs report problems. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.