The certificate transparency log is also a good place to look for clues. <a href="https://crt.sh" rel="nofollow">https://crt.sh</a>
I really wish that these services would stop requiring text records at the root. Ideally the key would be whateverservice-$RAND but at the very least put it under whateverservice.