And that's the authoritative nameserver for those domains? That's the nameserver that the rest of the world queries? If that's the case, you'll need to configure certbot to update that. This might be helpful in that regard:
See also:
3 Likes