Removing/correcting existing SOA record to allow Let's Encrypt to generate SSL CA

Ok, you may simply have to wait longer (24 hours, or even 48 hours) for everything to sort itself out.

You might like to look through the follow thread which lists numerous other resources for DNS debugging