Call Resolver.query, which dnspython 1.x has

Custom domain DNS checks were failing on production's dnspython 1.x, which also broke TLS renewals for custom domains. The calls now use `query`, which both 1.x and 2.x support.