Hey John,
If you had to switch DNS back to be able to issue the certificate, then you’ll also have to do that upon every single renewal, or manually copy the necessary DNS records to your DNS host. Therefore automatic renewal will fail, and since these certs must renew every few months, that’s kinda useless.

Let’s encrypt offers wildcard ssl which uses dns instead of http authorization. This means you can switch back the dns records, remove any broken/self-signed certificate, issue a wildcard let’s encrypt certificate and then switch the dns records back to the external website provider. The certificate will work for webmail/email and any other subdomain service and renew just fine.