Any reason you couldn't use the http-01 challenge? I think there are thousands of people who are using LetsEncrypt and have automated it successfully. So whatever you just said,
> all the LetsEncrypt certs I manage for clients
... if this contains some technical reason why it won't work, I think that's the problem.
But I'd be more inclined to believe you if you just told me that, your clients periodically need your assistance for other things, but they weren't going to call because as every good salesperson knows, "if you don't call, they don't come"... and since they trust you already, this is a reliable door-opener that gets you back into their offices, where you get to bill for something, even if this time they didn't need anything else... it gets you valuable face time and a pretty reliable, even if only nominal, payday.
If that's not it, then tell me that's not it, but... I think that's what you're doing. (And there's nothing wrong with that.)
`certbot certonly -d $1 -d www.$1 --manual --preferred-challenges dns-01`
The TXT records have to be edited manually then checked with DNS Toolbox. Once visible certbot can be allowed to process.