Regarding the correct certificate hash, the -show-certs command-line flag shows this output for rethinkdns:
[NOTICE] Advertised cert: [CN=rethinkdns.com] [6bd089f78d2efbc7d0a6870a2abe7d7be9245e035831ffa41e2429396d9e5488]
[NOTICE] Advertised cert: [CN=E1,O=Let's Encrypt,C=US] [cc1060d39c8329b62b6fbc7d0d6df9309869b981e7e6392d5cd8fa408f4d80e6]
[NOTICE] Advertised cert: [CN=ISRG Root X2,O=Internet Security Research Group,C=US] [5aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be]
[NOTICE] Advertised cert: [CN=ISRG Root X1,O=Internet Security Research Group,C=US] [11b102e6b1f63e528984d6025f32b138241fc88bbd7519574d70c9832d53e1e8]
I have used the last hash to create the dns stamp.
8f05287de9