certbot certonly [--dry-run] --manual --preferred-challenges dns-01 \
--domain example.com --domain www.example.com [...]
For each host passed via --domain, Let's Encrypt will prompt the user to create an _acme-challenge TXT record (_acme-challenge.example.com, _acme-challenge.www.example.com, etc.) with a specific value.