clarify that an SSL cert can remain self-signed on the non-primary domains if the domain isn't being used for web
whats_next: wrap output to the actual width of the terminal
whats_next: Allow the PRIMARY_HOSTNAME to not have an MX because the default value means the domain itself, which is what we want anyway
an mx record may be missing if the A record matches the A record of PRIMARY_HOSTNAME