I would like to add to this, as it might be useful for someone. I struggled to secure the no host domain, since lets encrypt only issued certificate for webmail.domain.com, and outlook constantly required to install the certificate.
Maybe there is an easier way to do this, I just wasn't able to find it, however I used the following resource to secure a wildcard SSL for the no host domain in question, GitHub - joohoi/acme-dns: Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.. And this tutorial: How To Acquire a Let's Encrypt Certificate Using DNS Validation with acme-dns-certbot on Ubuntu 18.04 | DigitalOcean.
Maybe there is an easier way to do this, I just wasn't able to find it, however I used the following resource to secure a wildcard SSL for the no host domain in question, GitHub - joohoi/acme-dns: Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.. And this tutorial: How To Acquire a Let's Encrypt Certificate Using DNS Validation with acme-dns-certbot on Ubuntu 18.04 | DigitalOcean.