@jror: Your name servers are responding with SERVFAIL to all CAA queries:
dig -t type257 vrouwejitske.nl @ns1.alt255.nl
; <<>> DiG 9.8.3-P1 <<>> -t type257 vrouwejitske.nl @ns1.alt255.nl
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 29875
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;vrouwejitske.nl. IN TYPE257
;; Query time: 35 msec
;; SERVER: 109.106.160.213#53(109.106.160.213)
;; WHEN: Sun Jul 16 15:27:45 2017
;; MSG SIZE rcvd: 33
That’s not a standards-compliant response for a non-existing DNS record. If you’re running your own DNS servers, you’ll probably be able to fix this by upgrading to the latest release of your DNS software. If your DNS is hosted by a third-party, you’ll need to contact them and ask for this to be fixed, or you’d have to look into migrating to an alternative DNS provider that’s not misbehaving.
There’s no workaround for this issue on the Let’s Encrypt side of things.