Should I authenticate the domain before creating the contact list?

There is no such restriction here. One can complete any of these two processes first, as they want.