Domain verification and domain-based enrollment
A company proves it owns acme.com, then people with verified @acme.com addresses can find or join its workspace automatically.
What it is
Domain verification proves that an organization controls a domain, usually by asking an admin to publish a random DNS TXT record. Domain-based enrollment uses that proof to route people with verified work addresses into the right workspace or identity provider. It is the machinery behind flows like 'enter your work email to continue.' Slack's setting to let anyone with a matching email domain join a workspace is the familiar consumer-facing version.
Reach for it when a company wants low-friction rollout without inviting every employee one by one. A verified domain can enable discovery, SSO routing, or automatic membership, but those are separate switches. Many customers want employees to discover the workspace while still requiring an admin to approve membership.
The dangerous shortcut is trusting the text after the @ sign. Verify the person's email as well as the company's DNS control, exclude public suffixes and consumer mail domains, and define whether subdomains count. Domains can also change hands, so recheck the TXT proof and provide a safe process for transferring or removing a claim.
Ask AI for it
Build domain verification and enrollment using a CSPRNG-generated DNS TXT challenge such as app-domain-verification=<token>. Normalize domains with IDNA, reject entries on the Public Suffix List, store only a SHA-256 hash of the token, and verify the exact TXT value before setting verified_at. Recheck ownership on a schedule and suspend auto-enrollment if the record disappears repeatedly. After the user's email address is separately verified, match its normalized domain to one active claim and either route to that organization's SSO or create a member role, according to explicit organization settings. Treat subdomains as separate unless configured, block consumer domains such as gmail.com, and require manual review for any domain transfer.