You're going to run into two issues: 1. Major services use CNAMEs or otherwise 'special' DNS records for the APEX record. But sometimes they offer the ability

You're going to run into two issues: 1. Major services use CNAMEs or otherwise 'special' DNS records for the APEX record. But sometimes they offer the ability to just add IPs to an A record, like Cloudflare does. 2. You may need to add a domain verification and/or SSL verification TXT records which means more interactions with your clients. Azure Front door even requires renewal of the APEX TXT record for SSL cert renewal (but not subdomains). Looks like ACM does the same (https://docs.aws.amazon.com/acm/latest/userguide/renew-publicly-trusted.html https://docs.aws.amazon.com/acm/latest/userguide/renew-publi...), but I haven't used it. At least for Azure and AWS, I think you're going to run into some frustrations over time if you don't control the DNS zone. Based on the docs, Cloudflare Universal SSL may be different, if you can pair it with one of their gateway products. Or you can wait for RFC 9460.