DNS challenge prefixes and CNAME targets are per-product now, and the web-dns-verify exemplar no longer recommends a leading underscore. Existing challenges keep the names they were born with. I was told this was more product-correct.