It works over IPv4 but it times out over IPv6. Let’s Encrypt defaults to IPv6 for validation if you have an AAAA record in your DNS (which you do), so you should make sure the IPv6 address is correct and that your server is listening on IPv6. If you can’t do that, an alternative is to remove the AAAA record and it will then use IPv4 for validation instead.