Seconded! I own a domain for our emails (no public Web presence) and use a subdomain (that's not publicly hosted, the names only exist in my pihole) which allows me to use foo.l.mydomain.com for each service. Since the names don't resolve publicly you'll have to use dns verification for let's encrypt, but that's not too hard to do.