So the issue seems to be with DuckDNS’ API - no combination i can find gives multiple txt entries.
I tried acme.sh, (using the DuckDNS support) - it’s really easy to use, but it too fails.
Acme.sh reports it has successfully updated the TXT records - which it has, but the first ones are over written so two of the four challenges fail.
The only way i can find to issue one certificate for everything is to do what griffin suggested and make non-wildacrd certs first and bin them, so I only get two challenges when issuing the ones i want.
Thanks again for the advice.