I’m using the most excellent Dehydrated utility, which is both easy to use and lightweight (few dependencies). These instructions assume you have control of a web server that can serve requests for the same domain as the mail server. Define MAILHOST to the FQDN of your mail host. Define WEBROOT to the directory of your mail server host in your web server, e.g., export WEBROOT=/var/www/htdocs/$MAILHOST First, grab Dehydrated. I put it in /usr/local: cd /usr/local sudo git clone https://github.com/lukas2511/dehydrated LetsEncrypt offers a couple of ways of verifying that you own the domain, but the one I’m using depends on LetsEncrypt being able to query a specific asset on the server.