Verified Domains
Prove that your company owns an email domain with a DNS TXT record, so Qualflare sends members at that domain to your SSO identity provider.
Reviewed by Qualflare Team on
Last updated
To have Qualflare send members to your identity provider, verify each email domain your company uses under Verified Domains by publishing a DNS TXT record; you need the Owner role in an Enterprise workspace that already has an SSO connection.
Before you begin
Owner · workspace (requires the Owner role in the workspace) Enterprise (available on Enterprise)- An SSO connection. Without one, the page shows Connect an identity provider first with a Go to Single Sign-On button.
- Access to your domain's DNS. Each domain can belong to one workspace only.
Verify a domain
Add the domain
Open Verified Domains in the workspace sidebar, under Administration. Enter a domain (for example acme.com) and click Add domain.
Publish the TXT record
Publish the DNS TXT record the page shows at your domain registrar.
Verify the domain
Click Verify once the record is live.
The domain's row goes from Pending to Verified. Each row shows its status and the exact record to publish, and the record stays visible after verification for auditing.
Keep the record published
Qualflare re-checks each verified domain's TXT record about once a day:
- A lookup that finds no record counts as a miss. A lookup that gets no answer, such as during a DNS outage, counts nothing.
- The workspace Owner gets an email on the first miss and on the last one before the limit.
- After 7 misses in a row, the domain is unverified. That has the same effect as Remove (see the Callout below).
- If that leaves the connection with no verified domain, Require SSO is turned off.
Regenerate or remove a domain
Regenerate token and Remove both stop routing the domain to your identity provider. Members at that domain who signed in through SSO are signed out right away, and their single sign-on link is removed. Nobody is removed from the workspace. Neither action works on the last verified domain while Require SSO is on.
Both are in the row's ⋯ menu. Regenerate token runs at once: it replaces the TXT value and sets the domain back to Pending until you verify again. Remove asks you to confirm with Remove domain.
Troubleshoot
The messages name your domain, shown here as acme.com. The row also shows the last failed check.
- "the expected TXT record was not found on acme.com": check the record at your registrar, wait for DNS to update, and click Verify again.
- "could not read DNS records for acme.com": the lookup itself failed. Click Verify again later.
- "too many verification attempts; generate a new record value to try again": use Regenerate token, publish the new value, then verify.
- "the domain 'acme.com' is already claimed by another workspace": each domain can belong to one workspace only.
- A consumer mail domain such as
gmail.com, or a public suffix such asgithub.io, can't be added. The message says the domain cannot be claimed for SSO, and why.
Next steps
- Require SSO for the members at your verified domains.
- SCIM Provisioning: let your identity provider add and remove members.
- Single Sign-On: the connection, role rules and session lifetime.
Single Sign-On
Connect a SAML 2.0 identity provider to a Qualflare Enterprise workspace, map groups to roles, set the session lifetime and require SSO safely.
SCIM Provisioning
Let your identity provider add, update and remove Qualflare workspace members over SCIM 2.0, with a one-time token and your SSO role rules.