For reference https://community.letsencrypt.org/t/tlsa-record-changes-with-every-renewal-process-which-breaks-dane/144145 https://gist.github.com/buffrr/609285c952e9cb28f76da168ef8c2ca6 https://www.huque.com/bin/gen_tlsa Verify with https://www.huque.com/bin/danecheck
We switched our Hetzner server to use only IPv6 address which saves us 0.6 euros per month. So switch to the use of AAAA record.