Verified domains: auto-join your team by email domain

This is the directory-free way to onboard a company. It is separate from, and works alongside, SAML single sign-on and SCIM: you can use verified domains with no IdP at all, or together with one.

Verified domains are managed by a workspace admin (role 20) at the bottom of /{workspace}/settings/sso.

Verified domains vs the SSO allowed-domains list

These two are easy to confuse, so keep them apart:

• Verified domains (this page) are proven by DNS and are what actually auto-join users into your workspace. Trust comes from the TXT record.
• The Allowed email domains field in the SAML section is only for sign-in routing: it tells the sign-in page which SSO workspace a work email belongs to. It is admin-typed, unverified, and never adds anyone to a workspace by itself.

If you want people to be added to your workspace by their email domain, use a verified domain.

How verification works

1. Add the domain. In the Verified Domains section, add the domain you own, for example acme.com. Ithura creates it in a pending state and shows you a TXT record to publish. Public email providers (like gmail.com) are rejected, because no single workspace can own them.

2. Publish the DNS TXT record. At your DNS provider, add a TXT record on the domain's root (host @) with the exact value Ithura shows:

   ithura-verify=<token>
   

   The token is unique to your workspace and domain.

3. Verify. Back in Ithura, click Verify now. Ithura does a live DNS lookup of the domain's TXT records and, on finding a match, marks the domain verified. DNS changes can take a few minutes to propagate, so if the first check does not find the record, wait and try again.

Only one workspace on the instance can hold a given domain in the verified state, so a domain cannot be claimed by two workspaces at once.

The joiner role

When you add a domain you choose the role new joiners receive: Guest or Member. Admin is deliberately not an option, so an auto-join can never grant workspace administration. You can change the role later from the same section.

Who gets auto-joined, and when

Once a domain is verified, a user is added to your workspace at the domain's role when their Ithura account has a verified email at that domain. The email verification is the proof of ownership, so a user cannot join simply by typing an address they do not control. Auto-join runs:

• after a SAML SSO sign-in,
• after an OAuth (social) sign-in, and
• when a signed-in user explicitly asks to join by domain.

A user whose verified email domain matches several workspaces is added to every one of them, each at that workspace's own domain role. Public email domains are always excluded.

Keeping domains honest

Ithura re-checks every verified domain's TXT record on a schedule (about once a day). If the record is missing on three consecutive checks, the domain is moved to a failed state and stops auto-joining new users until you republish the record and verify again. A transient DNS lookup error does not count against the domain, so a brief outage at your DNS provider will not revoke it.

Removing a domain from the section stops it being used for auto-join. Members who already joined keep their membership; removing a domain does not remove people.

What you see in the UI

Each domain row shows the domain, a status badge (Verified, Pending, or Not found), the TXT record to publish, a Verify now button, the joiner role selector (Guest or Member), and a control to remove it. The whole section is admin only.

Troubleshooting

Verification stays "pending" or shows "not found." The TXT record is missing, on the wrong host, or has not propagated. Confirm the record is on the domain root (host @), that its value is exactly ithura-verify=<token> with your token, and give DNS a few minutes. You can query it yourself with dig TXT acme.com (or your provider's DNS checker).

"This domain cannot be added." It is a public email provider, or another workspace has already verified it. Verified domains are for domains your organization owns.

A user with the right email was not added. Auto-join needs the user's Ithura email to be verified. Ask them to verify their email, then sign in again (or use the join-by-domain action). Also confirm the domain still shows Verified and has not slipped to failed after a DNS change.

I want new joiners to be admins. That is intentionally not possible. Add the person and raise their role manually, or invite admins directly.

For identity-provider single sign-on and enforced SSO, see the SAML SSO guide. For SCIM directory provisioning, see the Enterprise guide.