[aruametello]

i can vouch for desec.io for having the option to have TXT, NS, CNAME, etc dns entries on their free tier! (limited to 1 domain, up to 50 entries)

i really had a bad time trying to get a letsencrypt certificate through the regular auth because it does require ports 80 and 443 tcp that by ISP blocks.

(you can get a letsencrypt cert through a TXT entry too, but most free DDNS´s providers dont seem to offer that)

[dynip]

Dynip.dev solves with dns challenge and you can download the full chain and key either via api or the dashboard. Check /docs