Just tested again, with an DNS api token which has full zone access, but still get a `failed - status: Invalid` so something might still not be right here. The TXT record is published with name `_acme-challenge.*.domain.tld` when trying for `*.domain.tld` so that should be fine?