Does using just --staging invalidate cached authorizations? I have always assumed it did not but I never tested that.
Given their somewhat unusual nginx config, using the --nginx installer isn't what I'd recommend. Certainly opinions can vary on this 
That isn't why I suggested that certonly --dry-run though. I really wanted to see just that test.
@harrykotten Don't let these comments detract from the main problem which is the duckdns DNS system.