Update the files with the data necessary, such as zone name, name server and path to your key-file.
Your server needs nsupdate, which at least on debian is in the bind9utils package. You also need to create a keypair that you use for validate that you have the right to update the zone data.
Create your key by using `dnssec-keygen`, for example:
`$ dnssec-keygen -a HMAC-MD5 -b 512 -n USER keyname`
This will create to files, a .private, and a .key file. Upload the key file to your DNS administrator, or set up bind as per below. The .private file is, as the name implies, supposed to be private as anyone with that file can update your DNS zone. This is also the file that you should point out by the scripts.
It will then verify your domain, and then download the certificate. Afterwards, `sudo certbot renew` will update the certificate. Use a renew hook if you want to do something after renewal, such as reloading postfix, or whatever service that uses the certificates.