- Use sudo for mkdir/chown/chmod in home dir setup so www-data can execute
- Set public_html to 775 (group-writable) so www-data can deploy index.html
- Remove duplicate SPF from createZone defaults (provisionEmailDNS owns SPF/DMARC/DKIM)
- sudo mkdir/chown in provisionEmailDNS for opendkim key directory