RFC 8555 §8.4: the CA queries the TXT record (from several network perspectives) and compares its value with the expected digest. Because only DNS is involved, it works for hosts that are not reachable from the Internet, for wildcard certificates (*.example.com is validated at _acme-challenge.example.com) and behind any firewall.
It requires automation with write access to DNS, usually through a provider API, which is sensitive: credentials that can edit the zone can also redirect mail and web traffic. Common mitigations are a CNAME from _acme-challenge.example.com into a dedicated zone that the ACME client controls (acme-dns), and API tokens scoped to TXT records.
Failures usually come from propagation (the CA's resolvers see an old answer from a secondary server), several TXT values left from earlier attempts, wrong zone delegation for subdomains, and DNSSEC errors, which the CA must treat as failure rather than permission.