Handling of DNS SRV types (XMPP) with HTTP challenge?

[9peppe]

@_wojtek

_xmpp-client._tcp.domain.tld. 86400 IN SRV 5 0 5222 server.domain.tld.
_xmpps-client._tcp.domain.tld. 86400 IN SRV 5 0 5223 server.domain.tld.
_xmpp-server._tcp.domain.tld. 86400 IN SRV 5 0 5269 server.domain.tld.

Are you sure you need the certificate to be valid for domain.tld and not just for server.domain.tld? When using TLS with email you only need the certificate for whatever fqdn is in the MX record, not for the domain name in the email address.