Certbot unauthorized

This advice is usually true for web development, but it happens that it's a misconception when applied to Let's Encrypt. Differently from a web browser, Let's Encrypt never relies on DNS caching and always goes directly to the authoritative DNS server and gets the most recent version of the DNS records. So, DNS record propagation is not a factor in Let's Encrypt certificate issuance.

There can still be cases where you ask a provider to make DNS changes and they take some time to make the changes (because a human being is applying them or because a script only performs the changes once per hour or something), but these aren't the situations that people are usually referring to when they mention DNS propagation.