Verify a domain

A verified domain is an email domain, such as acme.com, that you have proved you own with a DNS TXT record. People who sign in with an address at a verified domain can join your organization without an invite.

Where to find it: Settings → Domains

Before you start

You also need access to the DNS settings of the domain.

In the app, Elaichi asks you to confirm it’s you before you add, verify, change, or delete a domain.

What a verified domain does

Add and verify a domain

1. Open Settings → Domains.
2. Click Add domain and enter the domain, for example acme.com.
3. Click Add domain again to confirm. Elaichi shows a TXT value.
4. Click the copy button next to the TXT value.
5. In your DNS provider, create a TXT record for the domain. Paste the value.
6. Return to Elaichi. The dialog checks for the record every 5 seconds. You can also click Check now. If you click Check later, verify the domain from its row menu.

If your DNS provider supports one-click setup, the dialog shows a Connect automatically button. It sends you to your provider to approve the record, so you do not need to paste anything.

You will see the status change from pending to verified, and the message Domain verified.

Set the default role for auto-join

1. In the Domains table, find the verified domain.
2. Open the Default role list in that row.
3. Choose a role.

The change saves when you choose the role. People who join because of this domain get that role. If you have not chosen a role, the list shows the role that new members get by default, usually Member. Choose Organization default to clear a role you set earlier.

Some roles appear greyed out. These are Org Owner, which cannot be handed out automatically, and any role that includes permissions you do not hold yourself.

Invites and SCIM can still give a person a different role.

Link a domain to an SSO connection

You set this on the SSO page, not on the Domains tab.

1. Verify the domain first.
2. Open Settings → SSO and SCIM → Domain routing.
3. In the row for the domain, choose an SSO connection. Choose Org default to use the connection that is marked as the default.

Only verified domains appear in Domain routing. Without a link, the sign-in screen cannot tell which identity provider should handle an email address.

Understand “Enforce SSO”

Enforce SSO is a switch on the SSO connection. It works only while the connection is active. When it is on:

• People whose email matches a linked verified domain must sign in through your identity provider.
• Sign-in with Google, GitHub, Microsoft, or an email code is refused for those addresses.
• A person who signs in through SSO for the first time still joins automatically.

Turn it on only after the connection is active, the domains are linked, and you have tested a real sign-in. See Set up single sign-on.

Delete a domain

1. In the Domains table, open the row menu for the domain.
2. Choose Delete.
3. Confirm.

New people can no longer join automatically with that domain. Current members keep their access. If you linked the domain to an SSO connection, update Domain routing so sign-in still works.

What to know

• Elaichi stores domains in lowercase.
• A person can join your organization three ways: an invite, auto-join from a verified domain, or SCIM.
• SSO, SCIM, and group mappings need the Gold or Black plan. See Manage billing.

Related

• Set up single sign-on
• Provisioning members with SCIM
• Invite and manage people
• Roles and permissions