I’ve been looking over the different specs and implementations to find an answer to this question: Is it acceptable to “host” an actor and their collections on a different domain?
Consider the domain foo.com with a webfinger endpoint at foo.com/.well-known/webfinger and an actor with the address email@example.com. When the request is made to foo.com/.well-known/webfinger?resource=acct:firstname.lastname@example.org, the response would return an actor id of sub.foo.com/users/nick.
In this example, the top level domain wouldn’t have any functional activitypub resources. Practically, the subdomain sub.foo.com is the activitypub service, but the goal is to represent actors (users) with the bare domain.