diff --git a/README.md b/README.md
index 6734f51..1556ff8 100644
--- a/README.md
+++ b/README.md
@@ -122,8 +122,11 @@ one-shot migration. The hosted surface exposes public `/health`, `/ready`,
 
 ## Public Domains
 
-Domain support is declarative and does not mutate DNS. Configure public routing,
-export a credential-free plan, then probe the deployed attachment prefix:
+Domain support is declarative and does not depend on `@hasna/domains` at
+runtime. `domain configure` only stores local metadata; it does not deploy DNS,
+Cloudflare Workers, or provider routes. Configure public routing, export a
+credential-free plan, deploy it with your DNS/CDN provider, then probe the
+deployed attachment prefix:
 
 ```bash
 attachments domain configure \
diff --git a/src/cli/commands/domain.test.ts b/src/cli/commands/domain.test.ts
index f97a981..ed794af 100644
--- a/src/cli/commands/domain.test.ts
+++ b/src/cli/commands/domain.test.ts
@@ -42,6 +42,23 @@ async function runDomainCommand(args: string[]): Promise<string> {
 }
 
 describe("domain command", () => {
+  it("makes clear that configure only saves metadata and gives deployment next steps", async () => {
+    const output = await runDomainCommand([
+      "configure",
+      "--hostname",
+      "files.example.com",
+      "--provider",
+      "cloudflare",
+      "--attachments-origin",
+      "https://attachments-origin.example.com",
+    ]);
+
+    expect(output).toContain("Saved public-domain metadata for https://files.example.com/a.");
+    expect(output).toContain("No DNS records, Cloudflare Workers, or provider routes were deployed.");
+    expect(output).toContain("attachments domain plan --format cloudflare");
+    expect(output).toContain("attachments domain verify");
+  });
+
   it("stores path-routing origins and prints a Cloudflare route plan", async () => {
     await runDomainCommand([
       "configure",
diff --git a/src/cli/commands/domain.ts b/src/cli/commands/domain.ts
index 257ee8c..7665fee 100644
--- a/src/cli/commands/domain.ts
+++ b/src/cli/commands/domain.ts
@@ -66,7 +66,12 @@ function configureCommand(): Command {
         },
       });
 
-      process.stdout.write(`Configured ${baseUrl}${pathPrefix} as the attachment public route.\n`);
+      const planFormat = provider === "cloudflare" || provider === "opendomains" ? provider : "json";
+      process.stdout.write(
+        `Saved public-domain metadata for ${baseUrl}${pathPrefix}.\n` +
+          "No DNS records, Cloudflare Workers, or provider routes were deployed.\n" +
+          `Next: run \`attachments domain plan --format ${planFormat}\`, deploy the printed plan, then run \`attachments domain verify\`.\n`
+      );
     });
 }