Bind forgets my changes with nsupdate

[201907-bind at planhack.com]

>   My solution is not to mix dynamic update with other access.
>   Instead, I put in CNAMEs in the signed zone to a sub-zone (or other zone)
>   where I do exclusive dynamic update.  This isn't perfect, but it works
>   well enough to allow dns-01 (certbot/LetsEncrypt) to be able to refresh my
>   certificates.

Not perfect? What issues did you see? Thanks!