DNS appears to be fine - autodiscover.domain.org points at the same IP as mail.domain.org, and is listed as subject alternative name in the certificate, resolves fine. I also tried CNAME instead of A, ...