Your domain is using Google Cloud DNS, right? Unlike the Google Domains free DNS service, it has an API, and it’s supported by some ACME clients, so you can easily create certificates and automatically renew them.
If you were on Debian testing, you could just apt-get install Certbot and its Google Cloud DNS plugin, but the plugin is unfortunately not packaged on stretch. If you still want to use Certbot, there are less simple ways to install it, like using Docker.
You could use the client acme.sh with its lexicon plugin. (lexicon is a DNS library that supports a bunch of different services.)
There are also other options.