Domain verification (DNS TXT)

Verifying a domain proves to us that your organization controls it. Once it's verified, InviziPoll can trust that an address like jane@yourcompany.com belongs to your workspace, and you can limit SSO enrollment to those addresses.

#Where to find it

Open Admin in the sidebar (the shield icon), then the SSO & Provisioning tab. The Verified Domains card sits under the identity provider settings.

#Add and verify a domain

1. Add the domain. Type it in Add domain (for example yourcompany.com) and click Add. It appears under Domain claims as pending, with a TXT value next to it.
2. Copy the TXT value. Use the copy button beside it.
3. Create the record at your DNS provider. Add a TXT record on the domain itself (the root, often written @), with the value exactly as copied.
4. Wait for DNS. Give it a few minutes. Some providers take longer to publish a change.
5. Click Verify. We look up the record at that moment. On a match the claim turns verified.

#The record

The value looks like this, with your own token in place of the placeholder:

Type:  TXT
Name:  @   (the domain itself - not a subdomain)
Value: confipoll-verification=<your token>

The prefix confipoll-verification= is part of the value and must stay as it is. The token is unique to your workspace and that domain.

If Verify fails, you'll see "DNS TXT record not found or token mismatch". The usual causes are:

• The record was added to a subdomain instead of the domain itself.
• DNS hasn't published the change yet. Wait a little and click Verify again.
• The value was changed on the way in, for example extra quotes or a missing prefix.

We check only when you click Verify, so nothing happens in the background while you wait. You can leave the record in place afterwards.

#What verification switches on

• SSO enrollment by domain. The default JIT mode, Verified domain only, lets people join through SSO only if their email is on a verified domain. See SSO sign-in policy and JIT provisioning.
• The strict domain check. Require verified email domain on every SSO sign-in compares every SSO sign-in against your verified domains.
• Domain capture. Once SSO is active, anyone with an email on a verified domain must sign in with SSO. Password sign-in, sign-up and email sign-in links are refused for them, except that owners keep password sign-in as a break-glass route.
• Trusted addresses from SCIM. Accounts your directory creates are marked email-verified only when their domain is one you've verified.

#Good to know

• One workspace per domain. A domain can be verified by only one workspace. If another workspace already holds it, you'll see "Domain already verified by another organization".
• Subdomains are separate. Verifying yourcompany.com doesn't cover uk.yourcompany.com addresses. Add each domain your people's emails use.
• Removing a claim. Use the trash icon next to it. Removing a verified domain turns off everything above for that domain.

#Related

• SSO sign-in policy and JIT provisioning
• Single sign-on (SAML & OIDC)