Which cert-manager resource shows a reason such as "Waiting for dns-01 challenge propagation" while its self-check runs?

Answer: Challenge

Explanation

Each ACME Order creates one Challenge per domain, and the Challenge runs the self-check before asking the ACME server to validate. kubectl get challenges shows the state and reason for each. A self-check that keeps failing is retried every 10 seconds until someone fixes the cause.