NS DnsRecords are created twice

[anentropic]

I have the following code to create NS records for the three DigitalOcean nameservers against my app domain:

domain = do.Domain(
    "my-domain",
    name=APPS_DOMAIN,
    ip_address=droplet.ipv4_address,  # will also create an A record
)
for i in range(1, 4):
    do.DnsRecord(
        f"my-domain-ns-{i}",
        domain=domain.name,
        type="NS",
        value=f"ns{i}.digitalocean.com.",
        name="@",
    )

the first time I pulumi up I always end up with 6 NS records, i.e. two for each DnsRecord instance

If I look in the DO control panel I can see two identical records for each NS hostname

if I manually delete the duplicates and pulumi up --refresh they get recreated

what is going on here?