yep still paused
I see your root domain is using CloudFront. But, I don't see any A/AAAA records for it on that screen snap. Did you just not show them or are they in a different account maybe?
Yeah, if that zone only has an NS/SOA, and TXT you've added, then it's clearly not the one being used for actual DNS.
Even when quering the AWS nameservers directly I'm not seeing any TXT RR.
Also, maybe there's a logical explanation for this, but when I do a dig +trace for the domain, the NS RR for your domain are different in my results than shown in the screenshot of your Route53 DNS zone? Although when querying those NS, I'm also getting a NXDOMAIN result..
And the SOA RRs are different too.
Did I incorrectly configure the hosted zone in Route 53 ?
There's some AWS account (which isn't the same account that certbot is using) which has a Route 53 hosted zone which is what's actually being used.
It looks like the account you're using just created its own hosted zone for some reason, but nothing is actually pointing to it.
You need to either
- If you want to use this new hosted zone instead of the one that's currently being used, then put whatever other records you need the domain to have here, change the registrar configuration to point to this new zone's NS records, and delete the current zone from whatever other account currently has it, or
- Have certbot use credentials for the account which has the zone which is currently actually being used (and delete the hosted zone that isn't actually being used), or
- Create a new hosted zone in the account certbot is using for
configuration.wildlifetracking.net, delete the hosted zone in this account forwildlifetracking.net, and have the actual production account'swildlifetracking.netset up NS records for your subdomain to point to the certbot's account's hosted zone.
But I feel like you don't know what account is actually being used. Are you in some sort of test account, rather than your organization's production account, or something like that?
Indeed, several of us are using this domain to configure a software, so it's possible that there is indeed such an issue. I'm very sorry but I will have to leave now (the real wildlife is waiting for me), and I will pick this up again tomorrow. Thank you all for your help. I will try Peter's suggestion tomorrow. Have a good rest of the day, and thanks again.
Also, depending on what exactly you're trying to use the certificate for, you might be able to just use Amazon's AWS Certificate Manager certificates, which they'll handle issuing and renewing and configuring all for you, rather than trying to involve Certbot and Let's Encrypt at all. (And it's one of the few things AWS doesn't charge extra for, unlike many things where you pay by the byte 
)
Be careful out there, my wife saw a coyote crossing the road on her way home last night.
Hi Peter,
I deleted the hosted zone wildlifetracking.net in route 53 and created the zone configuration.wildlifetracking.net and added to it all the NS records tested by unbundtest.com, but I'm still getting NXDOMAIN and CERTBOT return Some Challenge have failed.
You don't add the NS records to the zone you have, they need to get added to the public zone which is actually serving wildlifetracking.net. You need to figure out which account is serving that and have it added there.
AWS has pretty decent documentation; you're trying to "Create a hosted zone for the subdomain, and create records in the new hosted zone":