Verify a Domain
Prove your company owns its email domain with a DNS TXT record.
SSO only applies to email domains your organization has verified. Verification proves you control the domain, so no other organization can route your employees' sign-ins.
Add the domain
- Go to Settings → Single sign-on.
- Under Company domains, enter your email domain (for example
acme.com) in Add a domain and click Add. - The domain shows Waiting for DNS record, with the record to publish:
| Type | Name | Value |
|---|---|---|
TXT | @ | armoriq-domain-verification=<your-token> |
Use the copy buttons on the page. The value is unique to your organization and domain.
@ means the domain itself (acme.com). If your DNS provider does not accept @, leave the name empty or enter the full domain.
Publish the record
Add one TXT record at the company that hosts your domain's DNS. It sits alongside your existing records and changes nothing else.
- Open My Products → Domains, select the domain, then DNS.
- Click Add New Record.
- Type: TXT. Name:
@. Value: the value from ArmorIQ. TTL: leave the default. - Click Save.
- Select the domain, then DNS → Records.
- Click Add record.
- Type: TXT. Name:
@. Content: the value from ArmorIQ. - Click Save.
- Open Hosted zones and select the domain.
- Click Create record.
- Leave Record name empty. Record type: TXT. Value: the value from ArmorIQ, in double quotes.
- Click Create records.
Create a TXT record on the root of the domain (often written @) with the value from ArmorIQ. If you are unsure where your DNS is hosted, look up the domain's name servers or ask whoever manages your domain.
Verify
New records can take a few minutes to appear, and occasionally longer. Back on the setup page, click Verify. When the record is found, the domain shows Verified.
To check the record yourself before verifying:
dig +short TXT acme.com
# or
nslookup -type=TXT acme.comThe output should include armoriq-domain-verification=.... You can delete the TXT record after the domain is verified, but keeping it does no harm.
Rules
- Company domains only. Shared email providers such as
gmail.comoroutlook.comcannot be used. - One organization per domain. Once a domain is verified, no other organization can verify it. If another organization already uses your domain, contact support.
- Up to 20 domains per organization. Add every email domain your team uses, for example
acme.comandacme.io.
Removing a domain
Click Remove next to the domain. If SSO is on, people on that domain stop signing in with SSO right away, and removing your last verified domain turns SSO off. ArmorIQ asks you to confirm before removing a verified domain.