Hi @sgp,
Not that long ago I had to increase the delay with deSEC's Name Servers ns1.desec.io and ns2.desec.org using the option --dns-desec-propagation-seconds=300; I had arbitrary selected 300 seconds (5 minutes).
See CAA record prevents issuance - #53 by Bruce5051