Descibe certbot use-case

[pawel-kow]

I expect you all know Certbot, the nifty little client that speaks to letsencrypt and obtains/updates certificates. If you ask it for a wildcard certificate it'll ask you to add/update a certain TXT record.

[PK] Certbot is a good example, which likely requires different handling than the Mox. Mox I would expect does more less one-off setup, where all RRs won't be changing any later, at least not in an unsupervised mode - only after configuration change of any sort. This is good for a synchronous flow. Certbot would rather expect to be able to renew the certificate after 3 months, so an asynchronous flow would be appropriate. It would have some specifics that DNS provider would have to care of, like having refresh token with lifespan long enough to match the renewal cycle. Anyway this is working in the protocol, there is an open source dynamic DNS client doing just that and heavily used in the wild.