Migrate zulip to chankillo and fix DNS issues

- Update `zulip` DNS to point at chankillo and support the DNS-01 challenge for
  wildcard certs
- MxToolbox identifies some issues, and they mostly seem fairly harmless, but
  also fairly harmless to fix, and making MxToolbox alerting more useful is
  good:
  - Use ns1, not ns, as the primary nameserver in the zone
  - Remove Linode nameserver that shares a subnet with another one
  - Remove ns3 (olinda), which isn't running right now and is on the same
    subnet as ns1 (chankillo)