diff --git a/management/dns_update.py b/management/dns_update.py
index 87046932..9f75325c 100755
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -288,13 +288,15 @@ def build_zone(domain, all_domains, additional_records, www_redirect_domains, en
 			if not has_rec(qname, "SRV"):
 				records.append((qname, "SRV", "0 0 443 " + env["PRIMARY_HOSTNAME"] + ".", "Recommended. Specifies the hostname of the server that handles CardDAV/CalDAV services for email addresses on this domain."))
 
-        # Adds CNAME records for hosted email address domains (Email addresses that are added apart from the PRIMARY_HOSTNAME)
+        # Adds autoconfiguration A records for all domains.
+        # This allows the following clients to automatically configure email addresses in the respective applications.
         # autodiscover.* - Z-Push ActiveSync Autodiscover
         # autoconfig.* - Thunderbird Autoconfig
 	if domain != env["PRIMARY_HOSTNAME"]:
-		for qname in ("autodiscover", "autoconfig"):
-			if not has_rec(qname, "CNAME"):
-				records.append((qname, "CNAME", env["PRIMARY_HOSTNAME"] + ".", "Provides autodiscovery support for hosted email address domains."))
+		if not has_rec("autodiscover", "A"):
+			records.append(("autodiscover", "A", env["PUBLIC_IP"], "Provides email configuration autodiscovery support for Z-Push ActiveSync Autodiscover."))
+		if not has_rec("autoconfig", "A"):
+			records.append(("autoconfig", "A", env["PUBLIC_IP"], "Provides email configuration autodiscovery support for Thunderbird Autoconfig."))
 
 	# Sort the records. The None records *must* go first in the nsd zone file. Otherwise it doesn't matter.
 	records.sort(key = lambda rec : list(reversed(rec[0].split(".")) if rec[0] is not None else ""))
diff --git a/management/web_update.py b/management/web_update.py
index 61b38a7b..871e7677 100644
--- a/management/web_update.py
+++ b/management/web_update.py
@@ -29,6 +29,12 @@ def get_web_domains(env, include_www_redirects=True, exclude_dns_elsewhere=True)
 		# IP address than this box. Remove those domains from our list.
 		domains -= get_domains_with_a_records(env)
 
+		# Add Autoconfiguration domains, allowing us to serve correct SSL certs.
+		# 'autoconfig.' for Mozilla Thunderbird auto setup.
+		# 'autodiscover.' for Activesync autodiscovery.
+		domains |= set('autoconfig.' + zone for zone, zonefile in get_dns_zones(env))
+		domains |= set('autodiscover.' + zone for zone, zonefile in get_dns_zones(env))
+
 	# Ensure the PRIMARY_HOSTNAME is in the list so we can serve webmail
 	# as well as Z-Push for Exchange ActiveSync. This can't be removed
 	# by a custom A/AAAA record and is never a 'www.' redirect.