There is no need to have an A record in the external DNS. The DNS challenge uses the contents of a TXT record, _acme-challenge.<YOUR_DOMAIN>, for verification. The certbot DNS plugins will automatically create the TXT record and delete it following verification.