Netlify automatic certificate renewal overwriting manual SSL settings on multi-domain sites

I manage a Netlify site with several custom domains that share one DNS zone, and I'm trying to decide how to handle SSL going forward. Netlify provisions Let's Encrypt certificates automatically and renews them silently, and I've read that this renewal can overwrite manual SSL configuration changes. Before I commit to either fully managed certificates or a manual setup, I want to understand the actual boundaries of this behavior.

My constraints: the domains are not all on Netlify DNS, so some rely on external DNS providers with TXT-record-based verification. The Netlify UI does not clearly state the expected TTL for those records, and with multiple domains in the same zone it's unclear how verification conflicts are detected or reported. Assume a current Netlify production site on the standard build and deploy pipeline.

Under what conditions does automatic renewal replace a manually configured certificate, and is there a supported way to opt out per domain? When two custom domains share one DNS zone, how does Netlify disambiguate TXT verification records, and where are conflicts surfaced? Is there a documented TTL recommendation for the verification TXT record when using an external DNS provider?