Comment by AtNightWeCode

The way that certbot works with let's encrypt the only surprise is that this does not occur more often. We have monitoring on several certs used for TLS. We should probably add an alert if an A-record changes as well.

I assume the root cause is DNS tricks.