LetsEncrypt recently reiterated the need for setting TLSA records for all of their certificates, including backup ones, not just the current X3. Here you can find convenient cheat-sheet with ready-to-use DNS records and appropriate hashes:

http://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html