[dsp1234]

Is it possible to get a Let's Encrypt certificate without a public facing website (which is unrelated to wanted to run a mail server)?

[tokenizerrr]

Yes, they recently enabled the DNS validation. Otherwise, it wants to use a webserver to validate ownership. It can spin up an embedded webserver if you don't have one already.