certbot / letsencrypt cert renewal via dns challenge

$ cat /etc/letsencrypt/renewal/example.com.conf
    # renew_before_expiry = 30 days
    version = 0.24.0
    archive_dir = /etc/letsencrypt/archive/example.com
    cert = /etc/letsencrypt/live/example.com/cert.pem
    privkey = /etc/letsencrypt/live/example.com/privkey.pem
    chain = /etc/letsencrypt/live/example.com/chain.pem
    fullchain = /etc/letsencrypt/live/example.com/fullchain.pem

    # Options used in the renewal process
    [renewalparams]
    account = {account name here}
    pref_challs = dns-01,
    authenticator = manual
    installer = None
    manual_public_ip_logging_ok = True

# >>>
    manual_auth_hook = /usr/local/sbin/certbot-hook-auth-example.com
    manual_cleanup_hook = /usr/local/sbin/certbot-hook-cleanup-example.com
# <<<

################################################################################

$ ls -l /usr/local/sbin/certbot-*-example.com
    /usr/local/sbin/certbot-hook-auth-example.com -> certbot-manual-local-isc-bind
    /usr/local/sbin/certbot-hook-cleanup-example.com -> certbot-manual-local-isc-bind

################################################################################

$ cat /usr/local/sbin/certbot-manual-local-isc-bind

    #!/bin/sh
    X=/dev/null

    set -e # fail fast in case of (any) error

    D=${CERTBOT_DOMAIN}
    [ -n "$D" ] # required env var

    F="/etc/bind/db.$D-letsencrypt"
    [ -f "$F" ] # file must exist

    V=''
    A=$(basename "$0"); case "$A" in
    "certbot-hook-auth-$D")
        V=${CERTBOT_VALIDATION}
        [ -n "$V" ] # required env var
    ;;
    "certbot-hook-cleanup-$D")
        V="o_0 oops! (= there's # no \$ interesting \\\" data"
    ;;
    *) exit 1 ;;
    esac

    rndc zonestatus "$D" 0<$X 1>$X 2>$X
    rndc reload "$D" 0<$X 1>$X 2>$X

    echo "_acme-challenge 300 IN TXT \"$V\"" > "$F"
    touch "$F"
    rndc reload "$D" 0<$X 1>$X 2>$X

################################################################################

$ grep -F CAA /etc/bind/db.example.com

    IN  CAA 0 issue "letsencrypt.org"
    IN  CAA 0 issuewild ";"

################################################################################

$ grep -F example.com-letsencrypt /etc/bind/db.example.com

    $INCLUDE /etc/bind/db.example.com-letsencrypt