It can be anything! An apex, subdomain, or even a URL.

Results fornms.yyz2.oniaas.io

Resolver

Location

A

Name	TTL	Value
nms.yyz2.oniaas.io	300	10.100.65.165

Name	TTL	Value
nms.yyz2.oniaas.io	300	0 issue "letsencrypt.org ; validationmethods=dns-01; accounturi=https://acme-v02.api.letsencrypt.org /acme/acct/1437231676"
nms.yyz2.oniaas.io	300	0 issuewild "letsencrypt.org ; validationmethods=dns-01; accounturi=https://acme-v02.api.letsencrypt.org /acme/acct/1437231676"