Plan one destination
Open Website hostnames or the storefront's Readiness action with the relevant DNS/settings permissions. Configure the expected IPv4/IPv6 addresses or a CNAME target, not both. Publish the exact application-generated ownership TXT at _emaila-verify.HOST with value emaila=TOKEN. Use the displayed token; never copy a placeholder or another installation's token.
Connect hosting and DNS
For automated DNS, select a complete locally managed zone and its enabled/tested DNS module connection. Import/enter every existing record before publication because the provider contract submits a full snapshot and cannot discover unknown remote records. The storefront helper changes only the target A/AAAA/CNAME and its own TXT while retaining the complete local MX/TXT/other records.
For cPanel mapping, choose the verified WHM connection, existing cPanel account and this installation's shared public directory. Writes must be permitted. The helper does not deploy another private application or replace a hostname mapped elsewhere. Select AutoSSL only if permitted, or install a trusted certificate manually. An accepted AutoSSL request means pending work, not a certificate already issued.
Readiness proof
Run readiness after propagation and issuance. It checks current ownership, expected A/AAAA/CNAME routing, trusted HTTPS and /.well-known/emaila-site-verification for this exact installation and hostname. Direct-IP plans reject unconfigured address families/aliases. CNAME plans validate every resolved public address within bounded checks. Redirects, private destinations, wrong application identifiers and invalid TLS do not pass.
Changing routing/hosting settings invalidates old proof. Removing ownership TXT revokes stale evidence. Activate only after the current plan passes. A reachable homepage alone is insufficient.
Recovery
If DNS publication is uncertain, preserve the draft and inspect the selected provider before retrying. If WHM mapping or AutoSSL times out, inspect the account because the request may already have succeeded. Keep the installation's source directory private; the public root must expose only the shared public_html content. See DNS zone publication.