If you're having trouble using Certbot and aren't sure you've found a bug or
request for a new feature, please first try asking for help at
https://community.letsencrypt.org/. There is a much larger community there of
people familiar with the project who will be able to more quickly answer your
questions.

My operating system is (include version):

Linux

I installed Certbot with (certbot-auto, OS package manager, pip, etc):

OS package manager, after building from source

I ran this command and it produced this output:

certbot certonly --dry-run -d
[failure]
Debug log shows that certbot ascended to the SOA which contained the CNAME, not the one in which the target of the CNAME was contained.

Certbot's behavior differed from what I expected because:

Certbot should follow the CNAME (or DNAME) record to find the proper zone to modify, and the proper name within that zone.

I have developed a patch which I have extensively tested, including in a live setup. I apologize if there are issues with style or it's "pythonicity"; I have only used Python a handful of times and so am pretty much a rank newbie at the language.