Cloudflare

# Install the module. It will pull in the parts of certbot that are needed
sudo apt install python3-certbot-dns-cloudflare

# Create a credential file. Certbot will save the path for use during renewals
sudo bash -c 'echo "dns_cloudflare_api_token = aLongStringOfChars" > /etc/letsencrypt/cloudflare.ini'
sudo chmod 600 /etc/letsencrypt/cloudflare.ini

DOMAIN=your.org

# We added a hook for mail, but substitute your own as desired
sudo certbot certonly \
    --agree-tos \
    --dns-cloudflare \
    --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
    --domains mail.$DOMAIN \
    --email postmaster@$DOMAIN \
    --deploy-hook "service postfix reload; service dovecot reload"