I’m not OP, but I use Caddy as a reverse proxy, which generates a wildcard TLS certificate via their Cloudflare integration (who host my DNS). At some point I’ll move off Cloudflare but I never intend to host my own DNS (or email).