You don't need to control the domain (only for wildcards), ability to serve under .well-known is enough.