You don't; DNS-01 doesn't require contacting any servers besides the DNS registrar, which is what makes it so nice. In practice, most domain registrars have ce

You don't; DNS-01 doesn't require contacting any servers besides the DNS registrar, which is what makes it so nice. In practice, most domain registrars have certbot plugins - you just grab your API key from their customer portal and put it in a file, then run certbot in DNS-01 mode and instruct them to use that. Certbot places a temporary TXT record, which gets verified and the certificate is issued. Then certbot removes the TXT record and that's that. If there's no plugin, you do that by hand, which works but is a bit more involved. You don't need a firewall for that or a DDNS client. Also if you have a weird registrar that only offers you to set NS records, most VPS providers have free DNS services.