NS records to connect your domain name registrar to your DNS host. You use
CNAME records to at your DNS host to connect your domain name to the IP address of your web host.
You could have:
Domain.com -> NS ns1.hostinger.com -> A 220.127.116.11
Or you could have:
Domain.com -> NS ns1.domain.com -> A 18.104.22.168
In this case both your domain registrar and your web host offer DNS hosting services. You can choose to use either.
According to domain.com documentation their free security certificates are based on
Let's Encrypt. Lets encrypt works like:
- You run the Lets Encrypt client to secure a domain name
- The client contacts Lets Encrypt servers and requests a security certificate
- The Lets Encrypt server asks for verification that you control the domain. It gives you a token to publish. There are variants for publishing it in a known location on your site, or in your DNS records.
- The Lets Encrypt client puts the token in place and lets the server know.
- The Lets Encrypt server verifies that the token has been publicly published and issues a security certificate for the domain
- The Lets Encrypt client installs the certificate in your web server.
Because domain.com is not your web host, that last step is not going to be automatic. That is a problem because the Lets Encrypt certificates expire every three months. Any process that requires manual steps is going to a burden and will likely get neglected at some point.
Hostinger will let you install a certificate from Lets Encrypt on their servers and you might even be able to automate the process, but it sounds like a bit of scripting to make it happen.
All this is to say that getting a security certificate for your domain is not as easy with your setup as you were hoping. It sounds like if you were hosting with domain.com, they could install and update the certificate for you. However, with third party hosting it is going to be much harder. It is certainly not going to work to just point DNS to domain.com.
Hostinger has a $12 "cheap lifetime SSL" option. My guess is that is just an up-front fee for having them set up LetsEncrypt for you and keep the certificate updated. Many web hosting companies will do the work of installing and updated LetsEncrypt certificates as part of your hosting plan. $12 isn't an unreasonable fee, but it something that is more usually included in hosting plans in my experience.