Well check the docs
iggydob Since I’m not using autodiscover/autoconfig for alias domains, are these domains excluded from Let’s Encrypt certificate requests?
right at start of docs:
For each domain you add, it will try to resolve autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN to its IPv6 address or - if IPv6 is not configured in your domain - IPv4 address. If it succeeds, a name will be added as SAN to the certificate request.
iggydob Will this help me avoid rate limit issues when scaling to 100+ domains?
Well you are planing to scale over 100 domain so nothing but allow SNI will help in your goal. (Unless Let’s encrypt change it’s rules or MC change provider or you setup own certificate provider).
iggydob Am I correctly avoiding unnecessary certificate generation?
This is wrong question, unless you allow SNI than you have only one certificate so no unnecessary certificate generation are in place and when you allow SNI one would assumed you need it,..
iggydob Is it secure to NOT have autodiscover/autoconfig DNS records for alias domains?
This is not question of security but question of user experience.
Edit: most-likely, I was wrong about avoid 100+ domains issue, if you will not use autoconfig and autodiscover than you are not generating alternative names into your certificate, than you will not hit this 100 domains alt name limit,..