A newly built ministry answers on a long temporary address until you give it its own. Attach the name FIRST, not last: the settings their domain company needs are only produced once the name is on the site, and every name gets its own set — you cannot do one and copy it to the rest.
Open the domain wizard from the tenant’s screen.
One site at a time — the website, the admin and the reader each take their own name.
Type the address on its own: no https://, no slash on the end.
For the public website the www version is added for you, so do not type that either.
Decide whether it is canonical — whether this is now THE address.
On, and the ministry’s emails and shared links start using the new name. Off, and the site answers on it but links carry on using the old one. Leave it off until the name is working.
Send the settings it shows to whoever looks after the ministry’s domain.
These are DNS records — the entries that decide where a web address points. Whoever changes them is not always the company the domain was bought from, which is why the Client panel records who it actually is.
Come back and open the wizard again once they have made the change.
It simply re-reads how things stand; opening it again starts nothing. The secure padlock can take a while to appear even after the settings are right, and it tells you when that is all it is waiting for.
Do not detach a domain to "retry" it. Detaching takes effect immediately and fails silently in a visitor’s browser; the console refuses a name the tenant record still uses for exactly that reason.
Every new name also has to reach the apps’ allowed origins. A domain that serves but cannot sign anybody in is almost always this.