# Consume Customer-Owned DNS and PCA Prerequisites

The TiDB and O11Y public hosted zones, parent DNS delegation, and customer PCA
are customer-owned, long-lived prerequisites. `byoc.customer` supplies the zone
names and IDs plus PCA ARN. Before any mutation, `cp9 byoc activate` uses the
customer account-setup profile to verify that the zones are public and match
their configured names, public delegation is effective, and the PCA belongs to
the configured customer account and target region with an acceptable state and
permission contract. A failed or ambiguous check blocks activation.

CP9 does not create, adopt, modify, or delete these resources. Normal destroy
removes the fixed account-setup stacks CP9 executed and every subsequent
session-owned regional/dataplane resource, but leaves the explicit customer
prerequisites intact. BYOC zero-residual proof therefore means zero CP9/session-
owned resources; it reports the retained prerequisites as excluded foreign
resources rather than cleanup survivors. This matches the customer onboarding
sequence and avoids requiring credentials for the parent DNS account.