Services
A wildcard record points every name under this domain at the server, so a new service needs no DNS work.
Ask the agent to deploy something and it arrives at <name>.mzworld.net with its own
certificate, renewed automatically.