Sweet next year letsencrypt will support a persisting DNS record so these tools don’t need access to DNS for renewal