You don't need to "edit zonefiles", and whether it's "logically removed" is kinda irrelevant? You simply set up a dynamically updateable zone and then have the

You don't need to "edit zonefiles", and whether it's "logically removed" is kinda irrelevant? You simply set up a dynamically updateable zone and then have the LE client call nsupdate, it couldn't be any easier, you don't even need sudo. You could also delegate DNS for your MX to the MX itself, of course, then you'd have pretty much the same setup as with the HTTP server on the MX, just using a DNS server instead. But that's just too complicated, really, using dynamic DNS is flexible and allows you to easily add other services that need certificates on any machine whatsoever with no need to have an HTTP (or any other) server running on the machine reachable from the outside.