<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
we use Letsencrypt to generate a certificate with DNS challenge. Ansible works great to satisfy the challenge. However, when we want to remove the record as it is no longer needed, ansible is reporting module failure.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
ansible **nsupdate**

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```
ansible 2.8.5
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.15+ (default, Oct  7 2019, 17:39:04) [GCC 7.4.0]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
ANSIBLE_PIPELINING(/etc/ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/etc/ansible/ansible.cfg) = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
DEFAULT_CALLBACK_WHITELIST(/etc/ansible/ansible.cfg) = [u'timer']
DEFAULT_HOST_LIST(/etc/ansible/ansible.cfg) = [u'/Ansible/inventory']
DEFAULT_LOG_PATH(/etc/ansible/ansible.cfg) = /var/log/ansible.log
DEFAULT_PRIVATE_KEY_FILE(/etc/ansible/ansible.cfg) = /etc/ansible/master.rsa
DEFAULT_ROLES_PATH(/etc/ansible/ansible.cfg) = [u'/etc/ansible/roles', u'/Ansible/roles']
DEFAULT_SSH_TRANSFER_METHOD(/etc/ansible/ansible.cfg) = scp
DEFAULT_VAULT_PASSWORD_FILE(/etc/ansible/ansible.cfg) = /root/.ssh/vault-pw.conf
HOST_KEY_CHECKING(/etc/ansible/ansible.cfg) = False
RETRY_FILES_ENABLED(/etc/ansible/ansible.cfg) = False
```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
CentOS Linux release 7.2.1511 (Core)

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- set_facts:
    zone_records:
      - name: '_acme-challenge.awx'
        state: absent
        type: TXT

- name: remove dns records from vars
  nsupdate:
    key_name: "{{ vault_nsupdate_key_name }}"
    key_secret: "{{ vault_nsupdate_key_secret }}"
    server: "{{dns_server}}"
    zone: "{{zone}}"
    record: "{{item.name}}"
    type: "{{item.type}}"
    state: "{{item.state}}"
  with_items: "{{zone_records}}"
  when: server_role == "master" and item.state == "absent"
```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
_acme-challenge.awx TXT record is removed from DNS server


##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes -->
I have to run ansible-playbook with **-vvv** (3 v) as "-vvvv(4v) will give ssh error:
```
Using module file /usr/local/lib/python2.7/dist-packages/ansible/modules/net_tools/nsupdate.py
Pipelining is enabled.
<dns01.lpr> ESTABLISH SSH CONNECTION FOR USER: None
<dns01.lpr> SSH: EXEC ssh -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o 'IdentityFile="/etc/ansible/master.rsa"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/eb56091f4e dns01.lpr '/bin/sh -c '"'"'/usr/bin/python && sleep 0'"'"''
<dns01.lpr> (1, '', 'Traceback (most recent call last):\n  File "<stdin>", line 114, in <module>\n  File "<stdin>", line 106, in _ansiballz_main\n  File "<stdin>", line 49, in invoke_module\n  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 430, in <module>\n  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 408, in main\n  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 225, in __init__\nTypeError: argument 2 to map() must support iteration\n')
<dns01.lpr> Failed to connect to the host via ssh: Traceback (most recent call last):
  File "<stdin>", line 114, in <module>
  File "<stdin>", line 106, in _ansiballz_main
  File "<stdin>", line 49, in invoke_module
  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 430, in <module>
  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 408, in main
  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 225, in __init__
TypeError: argument 2 to map() must support iteration
The full traceback is:
Traceback (most recent call last):
  File "<stdin>", line 114, in <module>
  File "<stdin>", line 106, in _ansiballz_main
  File "<stdin>", line 49, in invoke_module
  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 430, in <module>
  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 408, in main
  File "/tmp/ansible_nsupdate_payload_OWViZX/__main__.py", line 225, in __init__
TypeError: argument 2 to map() must support iteration

failed: [dns01.lpr] (item={u'state': u'absent', u'type': u'TXT', u'name': u'_acme-challenge.awx', u'ttl': u'3600'}) => {
    "ansible_loop_var": "item", 
    "changed": false, 
    "item": {
        "name": "_acme-challenge.awx", 
        "state": "absent", 
        "ttl": "3600", 
        "type": "TXT"
    }, 
    "module_stderr": "Traceback (most recent call last):\n  File \"<stdin>\", line 114, in <module>\n  File \"<stdin>\", line 106, in _ansiballz_main\n  File \"<stdin>\", line 49, in invoke_module\n  File \"/tmp/ansible_nsupdate_payload_OWViZX/__main__.py\", line 430, in <module>\n  File \"/tmp/ansible_nsupdate_payload_OWViZX/__main__.py\", line 408, in main\n  File \"/tmp/ansible_nsupdate_payload_OWViZX/__main__.py\", line 225, in __init__\nTypeError: argument 2 to map() must support iteration\n", 
    "module_stdout": "", 
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", 
    "rc": 1
}
```

Here is the result when running ansible-playbook with -vvvv (4v):
```paste below
Using module file /usr/local/lib/python2.7/dist-packages/ansible/modules/net_tools/nsupdate.py
Pipelining is enabled.
<dns01.lpr> ESTABLISH SSH CONNECTION FOR USER: None
<dns01.lpr> SSH: EXEC ssh -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o 'IdentityFile="/etc/ansible/master.rsa"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/eb56091f4e dns01.lpr '/bin/sh -c '"'"'/usr/bin/python && sleep 0'"'"''
<dns01.lpr> (1, '', 'OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017\r\ndebug1: Reading configuration data /root/.ssh/config\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug2: mux_client_hello_exchange: master version 4\r\ndebug3: mux_client_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux_client_request_session: entering\r\ndebug3: mux_client_request_alive: entering\r\ndebug3: mux_client_request_alive: done pid = 26756\r\ndebug3: mux_client_request_session: session request sent\r\ndebug1: mux_client_request_session: master session id: 2\r\nTraceback (most recent call last):\n  File "<stdin>", line 114, in <module>\n  File "<stdin>", line 106, in _ansiballz_main\n  File "<stdin>", line 49, in invoke_module\n  File "/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py", line 430, in <module>\n  File "/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py", line 408, in main\n  File "/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py", line 225, in __init__\nTypeError: argument 2 to map() must support iteration\ndebug3: mux_client_read_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 1\r\n')
<dns01.lpr> Failed to connect to the host via ssh: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /root/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: auto-mux: Trying existing master
debug2: fd 3 setting O_NONBLOCK
debug2: mux_client_hello_exchange: master version 4
debug3: mux_client_forwards: request forwardings: 0 local, 0 remote
debug3: mux_client_request_session: entering
debug3: mux_client_request_alive: entering
debug3: mux_client_request_alive: done pid = 26756
debug3: mux_client_request_session: session request sent
debug1: mux_client_request_session: master session id: 2
Traceback (most recent call last):
  File "<stdin>", line 114, in <module>
  File "<stdin>", line 106, in _ansiballz_main
  File "<stdin>", line 49, in invoke_module
  File "/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py", line 430, in <module>
  File "/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py", line 408, in main
  File "/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py", line 225, in __init__
TypeError: argument 2 to map() must support iteration
debug3: mux_client_read_packet: read header failed: Broken pipe
debug2: Received exit status from master 1
failed: [dns01.lpr] (item={u'state': u'absent', u'type': u'TXT', u'name': u'_acme-challenge.awx', u'ttl': u'3600'}) => {
    "ansible_loop_var": "item", 
    "changed": false, 
    "item": {
        "name": "_acme-challenge.awx", 
        "state": "absent", 
        "ttl": "3600", 
        "type": "TXT"
    }, 
    "module_stderr": "OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017\r\ndebug1: Reading configuration data /root/.ssh/config\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug2: mux_client_hello_exchange: master version 4\r\ndebug3: mux_client_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux_client_request_session: entering\r\ndebug3: mux_client_request_alive: entering\r\ndebug3: mux_client_request_alive: done pid = 26756\r\ndebug3: mux_client_request_session: session request sent\r\ndebug1: mux_client_request_session: master session id: 2\r\nTraceback (most recent call last):\n  File \"<stdin>\", line 114, in <module>\n  File \"<stdin>\", line 106, in _ansiballz_main\n  File \"<stdin>\", line 49, in invoke_module\n  File \"/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py\", line 430, in <module>\n  File \"/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py\", line 408, in main\n  File \"/tmp/ansible_nsupdate_payload_pwj0Q7/__main__.py\", line 225, in __init__\nTypeError: argument 2 to map() must support iteration\ndebug3: mux_client_read_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 1\r\n", 
    "module_stdout": "", 
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", 
    "rc": 1
}
```

description:
            - Use this TCP port when connecting to C(server).
        default: 53
        version_added: 2.5
    key_name:
        description:
            - Use TSIG key name to authenticate against DNS C(server)
    key_secret:
        description:
            - Use TSIG key secret, associated with C(key_name), to authenticate against C(server)
    key_algorithm:
        description:
            - Specify key algorithm used by C(key_secret).
        choices: ['HMAC-MD5.SIG-ALG.REG.INT', 'hmac-md5', 'hmac-sha1', 'hmac-sha224', 'hmac-sha256', 'hmac-sha384',
                  'hmac-sha512']
        default: 'hmac-md5'
    zone:
        description:
            - DNS record will be modified on this C(zone).
            - When omitted DNS will be queried to attempt finding the correct zone.
            - Starting with Ansible 2.7 this parameter is optional.
    record:
        description:
            - Sets the DNS record to modify. When zone is omitted this has to be absolute (ending with a dot).
        required: true
    type:
        description:
            - Sets the record type.
        default: 'A'
    ttl: