Apparently one has to wait, but DNS can't be involved at this step. (As the DNS records had already to be ready and presumably propagated for the ACME challenge to work.) So let's assume it's the content delivery network serving the certificate that needs some time here.