DCTL5001

syncPubKeyDomain is required

The Service provider must publish their public key and place it in a DNS TXT record in a domain specified in the template in syncPubKeyDomain. To allow for key rotation, the host name of the TXT record must be appended as another variable on the query string of the form: key=_dcpubkeyv1

The Domain Connect project has a page that helps create TXT records in expected format. Once the key is exposed with the p=N,a=RS256,d=... headers you can try if the key works with debug tooling.

See also Cloudflare Domain Connect page.