For server domains (under the "servers" section), the DNS needs to be delegated to your Enhance DNS for automatic LetsEncrypt to work. This is because server domains use DNS validation since the target server may not be running a web server if it's just doing email.
Website SSL uses HTTP validation and therefore the DNS can be external, the A record just needs to point to the right server.
If you're not ready to change the DNS yet, you can request the certificate and do the validation manually using certbot or similar tools then upload the completed certificate to Enhance. However it won't auto renew until the DNS is updated.