I think for (c), we have EPP: https://en.wikipedia.org/wiki/Extensible_Provisioning_Protocol https://en.wikipedia.org/wiki/Extensible_Provisioning_Protoc... Bu

I think for (c), we have EPP: https://en.wikipedia.org/wiki/Extensible_Provisioning_Protocol https://en.wikipedia.org/wiki/Extensible_Provisioning_Protoc... But I have never seen it in operation personally, having never worked for this kind of ISP. For (b), I don't see why you couldn't install the required records using dynamic DNS, which is already widely implemented and deployed in other contexts. (It's the RFC 2136 item on the Certbot list.) It doesn't seem to be very commonly offered by DNS providers, though. It does work if you maintain the zone locally and use zone transfer (presumably with TSIG for authentication …) to publish to public DNS servers (if you don't want to run the public DNS servers yourself). I think this space is a bit of a mess because no one is really expected to put this together themselves, rather they should get everything (mail hosting, web hosting, plus certificates) from a service provider. It's a wonder that grassroots participation is still possible at all.