Thank you both for your replies.
The DNS server is working otherwise Let's Debug would fail.
Think the problem is the same as this, reported recently:
The first resolution of 'www.osteotech.pt' is done with IPv6 and it points to 'osteotech.pt' as it's a CNAME but second resolution (A Record of 'osteotech.pt') does not reply with IPv6 and certbot doesn't fallback to IPv4, it just fails.