Domains
Add company domains, prove control with a DNS TXT record, and optionally require every enterprise member to be on a verified domain.
Verified domains are the foundation for the optional member restriction (below) and for future home-realm/SSO discovery. The Domains tab shows each domain, its verification status, and verified date.
Enterprise verified domains are separate from a workspace's Allowed Email Domains (Workspace Security). Workspace allowlists govern who can join that workspace; enterprise verified domains govern enterprise-level membership policy. Adding an enterprise domain never changes any workspace's allowlist, and vice versa.
Verify a domain with DNS TXT
A domain only becomes a security boundary once you prove you control it. Integrity verifies control with a DNS TXT record — the same proof-of-control approach used by Google Workspace, Vercel, and Cloudflare.
Add the domain
On the Domains tab, add the domain (for example example.com). It is created in a Waiting for DNS state, and Integrity generates a unique verification token for it.
Publish the TXT record
Expand the domain row to see the exact record. At your DNS provider, create a TXT record:
- Type:
TXT - Host / Name:
_irsiks-domain-verification.example.com - Value: the
irsiks-verify-…token shown for that domain
Some registrars want the host as just _irsiks-domain-verification without the trailing domain. Either form is correct. DNS changes can take a few minutes (occasionally longer) to propagate.
Check DNS
Back on the Domains tab, click Check DNS. Integrity resolves the public TXT records for that host and looks for your token. On a match, the domain flips to Verified. If the token isn't found yet, the row stays Waiting for DNS / Verification failed and shows the TXT values it actually saw, so you can spot a copy/paste mismatch.
A given domain can be verified by only one enterprise at a time. If another enterprise has already verified the same domain, verification is refused.
Restrict members to verified domains
Optionally require that every enterprise member and admin has an email on one of your verified domains.
- It is off by default.
- It cannot be enabled until the enterprise has at least one verified domain.
- When enabled, adding a member with an out-of-domain email is rejected.
- Enabling it later does not remove existing members — the Users tab instead flags anyone currently outside the policy for your review.
- There is no exemption: when the restriction is on, the rule applies to every member added through the add flow.
You toggle this on the Security tab — see Security & Audit.