DNS-01 explained
A TXT record at _acme-challenge proves you control the DNS zone. That is how wildcards get issued.
The record
The CA gives a token. The client publishes a digest as TXT. After the CA sees it, the authorization becomes valid.
Automation
Cloudflare and other DNS APIs can create the record for seconds or minutes, then delete it. Manual mode is the same record, typed by a human.