How to connect Azure static app to another DNS provider (HostPapa/cpanel)? Validation Failed!

I’m trying to point portal.example.com (DNS hosted on cPanel/HostPapa) to an Azure Static Web App (MyPortalApp, region East US 2). DNS looks correct: I have CNAME portal → <myapp-default>.azurestaticapps.net, no conflicting A/AAAA on portal, apex A left in place for example.com, and a CAA at the apex: 0 issue "digicert.com".

Earlier an IPv6 AAAA caused the host’s placeholder page, but that’s been removed. The remaining issue seems Azure-side: the Add custom domain side panel shows Validated (CNAME), but the list shows Validation failed; Activity Log shows Microsoft.Web/staticSites/customdomains/write → ResourceOperationFailure (terminal state Failed), and the CLI az staticwebapp hostname set -n MyPortalApp -g <resource-group> --hostname portal.example.com returns “(Unspecified) Code: Unspecified” even after hostname delete and waiting 15+ minutes.

A canary alias (testportal.example.com) also fails the same way. What’s the reliable way to bind this? My plan per docs is: delete binding → wait 15 min → temporarily remove the CNAME → add Azure’s TXT token (Name: portal, Value: <validationToken>) to validate → Add → restore the CNAME for traffic, keeping the CAA. Are there known issues in requiring TXT (and causing “Unspecified” with CNAME), and where else can I see deeper error details beyond Monitor → Activity log?