dns-digitalocean: Ignore SOA TTL in favor of explicit TTL argument (#9149)

* Ignore SOA TTL in favor of explicit TTL argument

`domain.ttl` should be `None` so that the `self.ttl` argument in 
`add_txt_record()` is not ignored (`domain.ttl` takes precedence).

* Document mitigation for dns-digitalocean ignoring the 30 second TTL.

certbot-dns-digitalocean/certbot_dns_digitalocean/_internal/dns_digitalocean.py

@@ -82,6 +82,10 @@ class _DigitalOceanClient:
 
         try:
             domain = self._find_domain(domain_name)
+            # The TTL value is set to the SOA record's TTL. Unless set to a falsy value,
+            # the optional TTL argument to add_txt_record() would be ignored.
+            # See https://github.com/certbot/certbot/pull/9149 for details.
+            domain.ttl = None
         except digitalocean.Error as e:
             hint = None
 

certbot/CHANGELOG.md

@@ -19,6 +19,7 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 ### Fixed
 
 * GCP Permission list for certbot-dns-google in plugin documentation
+* dns-digitalocean used the SOA TTL for newly created records, rather than 30 seconds.
 
 More details about these changes can be found on our GitHub repo.