&gt; There is a difference between &quot;I can serve content under this domain (currently)&quot; and &quot;I control this domain (and can decide where it points)&quot;.<p>Agreed. However, I have a hard time believing that it&#x27;s a net win to make it impossible for people who are permitted to control the machines that a DNS record points to, but are not permitted to alter that DNS record and&#x2F;or anything under it [0] to get a cert from Let&#x27;s Encypt.<p>[0] Or are -perhaps- using a DNS hosting provider that doesn&#x27;t let you add TXT or CNAME records. (I&#x27;ve used such a sorry provider in the past. :&#x2F; )