Skip to content
Tallyfy
Developers

Domain verification

Prove you own your email domain

Section titled “Prove you own your email domain”

Domain verification tells Tallyfy that an email domain like acme.com really belongs to your organization. You prove it by adding one DNS TXT record. Once a domain is verified, an SSO connection you set up yourself can sign in people from that domain, and you can enforce SSO-only login. You do all of this yourself under Settings > Organization > Security > Domains, on any paid plan.

Why it matters: SSO assertions carry an email address, but an email address alone isn’t proof. Any identity provider can technically assert any email. A verified domain is the check that stops someone whose own IdP claims an @acme.com address from signing in as one of your Acme people.

What a verified domain turns on

Section titled “What a verified domain turns on”

A domain stays unverified until you publish the TXT record. Verifying it turns on three things:

FeatureWhat verification enables
SSO sign-inA connection you set up yourself signs in only people whose email is on a verified domain, existing members and newcomers alike. You can’t turn it on until at least one domain is verified.
Accounts on first sign-in (JIT)People new to your org whose email is on a verified domain join it on their first SSO sign-in, unless SCIM is on. Tallyfy creates their account if they don’t have one yet.
SSO-only enforcementThe Require SSO switch stays disabled until you have a verified domain, because enforcement without proof of ownership is unsafe.

A connection Tallyfy support set up for you doesn’t need a verified domain to sign people in. The Auto Join setting for email signups is separate, and SSO never reads it.

Add and verify a domain

Section titled “Add and verify a domain”

You’ll need access to your domain’s DNS settings (or someone on your team who has it). The record is a standard TXT entry, the same kind you’d add for email or other service verifications.

  1. In Tallyfy, go to Settings > Organization > Security > Domains.
  2. Click Add domain and enter your domain, for example acme.com. Use the bare domain, not a full email address.
  3. Tallyfy shows you a TXT record name and a unique value to publish. Copy both with the copy buttons.
  4. In your DNS provider (GoDaddy, Cloudflare, Route 53, and so on), add a new TXT record using that name and value. Save it.
  5. Back in Tallyfy, click Verify. Tallyfy looks up the TXT record and, once it matches, marks the domain verified with a badge.

DNS changes can take a few minutes to propagate, sometimes longer. If the first verify attempt fails, wait a bit and try again. The token stays valid, so you don’t need to start over.

After verification

Section titled “After verification”

Once the badge shows verified, you can keep the TXT record in place. Tallyfy reads the record only when you click Verify, so removing it later doesn’t un-verify the domain. Starting verification again with a new token does.

Add every domain your team uses for email. If people sign in from both acme.com and acme.co.uk, verify both so SSO sign-in and enforcement cover everyone. An address one level below a verified domain counts too: with acme.com verified, it@uk.acme.com is on it, but it@a.uk.acme.com isn’t.

Troubleshooting

Section titled “Troubleshooting”

Verification not passing? Check these:

  • The TXT record name and value match exactly what Tallyfy shows. A trailing space or a missing character will fail.
  • You added a TXT record, not a CNAME or A record.
  • You’re verifying the bare domain (acme.com), not a subdomain or an email address.
  • Enough time has passed for DNS to propagate. Try again after a few minutes.
  • You can confirm the record is live with a public DNS lookup tool before clicking Verify again.
Section titled “Related articles”
Get in touch
About Tallyfy