sudo certbot certonly --manual --preferred-challenges dns -d mail.netsec.pro
Certbot will show a TXT record name and value to add at your DNS provider. Add it, wait for it to appear in public DNS, then continue the Certbot prompt. Manual DNS renewals require repeating that process each time; for automatic renewal, use a Certbot DNS plugin for your DNS provider.
Then configure Postfix and Dovecot to use the resulting fullchain.pem and privkey.pem files for that certificate, and reload them. If the mail server can serve the ACME HTTP challenge directly on port 80, another option is Certbot’s webroot authenticator—but DNS-01 avoids involving the web proxy.