The Let's Encrypt HTTP challenge failed: acme error 'urn:acme:error:connection': DNS problem: SERVFAIL looking up A for domain.com

[Nit]

@serverco

Having a secondary DNS provider that provides the IP may not help if the primary authoritative nameservers do not respond.

Let's Encrypt, to ensure that they are getting the correct IP address, will always ask your authoritative namesevers (whereas your browser will typically get the IP from any nameserver that responds).

Note that both "primary" and "secondary" name servers are authoritative. An outside observer cannot known which of your NS is primary or not. It just sees all NS servers as authoritative servers.