Verifying a Domain

Claim an email domain (like acme.com) for your organization to control who from that domain ends up joining you. Once a domain is verified, anyone signing in via SSO with an email at that domain is invited to join your organization, or can request to join it (if approval is required)

This is what you'd use to onboard a whole company at once without sending individual invites.

• You need to be an owner or admin of the organization.
• You need DNS control of the domain - you'll be adding a TXT record to prove ownership. If you don't manage DNS yourself, you'll need to hand the record to whoever does.
• Public email providers like gmail.com, outlook.com, yahoo.com, etc. are blocked. The domain has to be one you actually operate.
• Each domain can only be claimed by one organization at a time. If someone else has already verified it, you can't claim it.

1. In the sidebar on the left, find the Organization section.
2. Click Details under it. The Organization Details page opens.

1. Across the top of the Settings page, there's a row of tabs.
2. Click the Domains tab.

If you haven't claimed any domains yet, you'll see the message No domains claimed yet.

1. Click Add domain in the top right of the page. A dialog opens.

2. In the Domain field, type the bare domain - for example mycorp.com.

• No @ symbol in front.

• No https:// in front.

• No subdomains unless you specifically want a subdomain (use the apex domain in most cases).

3. Decide what to do with the Require approval toggle: You can change this later, so go with whichever makes sense now.

• Off (the default): anyone signing in with an @mycorp.com is invited, and can join your organization with no admin review.

• On: Users with matching domains e.g @mycorp.com can request to join your organization, but an admin or owner approval will be required.

4. Click Add domain at the bottom of the dialog.

The dialog updates to show DNS verification instructions.

The dialog now shows two pieces of information you'll need to give your DNS provider:

• Record name: the domain itself (e.g. mycorp.com).
• TXT value: a string that looks like synteq-verify=….

1. Click the TXT value (or the copy icon next to it) to copy it to your clipboard.
2. Go to your DNS provider's control panel (Cloudflare, Route 53, GoDaddy, etc.).
3. Add a new DNS record with these settings:

   1. Type: TXT
   2. Name / Host: the domain itself (or @ if your DNS panel uses @ for the apex domain)
   3. Value: the synteq-verify=… string from the dialog
   4. TTL: whatever your provider's default is. 300 seconds is fine.

4. Save the record in your DNS provider.
5. Back in the portal dialog, click Done to close it.

The domain now appears on the Domains tab with a Pending badge.

1. Back on the Domains tab, find the row for your new domain. It'll have a Pending badge on it.

2. Click anywhere on the row to expand it.

3. On the right side of the expanded row, click Verify now.

The portal does a DNS lookup, finds the TXT record, and confirms it matches what was generated for you.

• On success: the Pending badge flips to Verified in green. If any users with @mycorp.com addresses already had portal accounts, a toast tells you how many of them were auto-joined (or queued for approval) by the same action.
• On failure: you'll see TXT record not found. DNS changes can take a few minutes to propagate around the internet. Wait 2-5 minutes and click Verify now again. If it still fails after 15 minutes, double-check the record in your DNS panel - it's almost always a typo or wrong record type.

If you decide later that you want to change how new sign-ins are handled:

1. Expand the domain row by clicking it.

2. Flip the Require approval toggle inside the expanded row.

3. A confirmation dialog explains the change. Slide to confirm.

The new setting takes effect immediately for any new sign-ins. People who already joined under the old setting are unaffected.

If you no longer want to claim a domain:

1. On the domain's row in the Domains tab, click the trash icon.

2. A confirmation dialog opens asking for your password to confirm.

3. Type your password.

4. Slide the Slide to delete rail to the right.

The domain is removed. Anyone already in your organization keeps their access - removing the domain doesn't kick existing members out. It just stops future sign-ins from that domain auto-joining.