Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-rfc2136, Installer None
Simulating a certificate request for webmail.example.com
Performing the following challenges:
dns-01 challenge for webmail.example.com
Waiting 60 seconds for DNS changes to propagate

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Challenges loaded. Press continue to submit to CA.

The following FQDNs should return a TXT resource record with the value
mentioned:

FQDN: _acme-challenge.webmail.example.com
Expected value: iem-iL7hpw5JeVZMqxM-z9bG_VOcrsSC1GRRcgsuQQE
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Waiting for verification...
Challenge failed for domain webmail.example.com
dns-01 challenge for webmail.example.com

Certbot failed to authenticate some domains (authenticator: dns-rfc2136). The Certificate Authority reported these problems:
  Domain: webmail.example.com
  Type:   unauthorized
  Detail: Incorrect TXT record "WrBP2Uyn4aJFUxD2DDa1nInnL2wVwBhxTm7RcsKR" found at _acme-challenge.webmail.example.com

Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-rfc2136. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-rfc2136-propagation-seconds (currently 60 seconds).

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.