I’m also using caddy with desec.io. When first triggering the challenge for an entry, it CSV fail a couple of times. I think it just takes a while for the DNS entry to be available.

Another thing that I’ve experienced is that I can’t use wildcard subdomain entries. My guess is that it’s somehow because I only have public IPv6 addresses (but I don’t remember the details). I have configured an internal DNS with the wildcard entey since I’m only ever connecting to that host via wireguard from outside my network. For the host itself I’ve created a regular AAAA record.