We run Tailscale, which sometimes has internal routes to things. These override all DNS address entries for specified domains, which breaks verifying ACME TXT records, which prevents us fetching certificates.
Resolving ACME using Cloudflare avoids the issue...
manually merged due to tangled error