What is the difference between unable to complete and fail?
I just set firewall to block all inbound IPv6 traffic and a certbot --dry-run failed with timeout even though IPv4 remained fine. Interesting, if the --dry-run started but was still hung / waiting for timeout and I re-opened IPv6, the --dry-run would complete.