Thanks for that! I'll take a look at it when I get home.
I believe the DNSSEC thing was just part of proving ownership while I was getting my letsencrypt SSL certificate, I think I can remove the DNSSEC entry now, since I've installed the certificate and don't get any certificate errors now.