It can be anything! An apex, subdomain, or even a URL.

Results forpuppetdb.yyz2.oniaas.io

Resolver

Location

AAAA

Name	TTL	Value
puppetdb.yyz2.oniaas.io	300	2605:6f00:aaaa:301:1::3b5 / HostPapa

Name	TTL	Value
puppetdb.yyz2.oniaas.io	300	0 issue "letsencrypt.org ; validationmethods=dns-01; accounturi=https://acme-v02.api.letsencrypt.org /acme/acct/1472184176"
puppetdb.yyz2.oniaas.io	300	0 issuewild "letsencrypt.org ; validationmethods=dns-01; accounturi=https://acme-v02.api.letsencrypt.org /acme/acct/1472184176"