Verify your domain with a DNS TXT record

Before a domain can route to your SSO connection, you prove you own it by publishing a DNS TXT record we generate. Domain verification is the only ownership check — and each domain can be claimed by exactly one connection.

How verification works

When you claim a domain in the Domain Verification card, we generate a unique token and show you the exact TXT record to publish. You add that record at your DNS host, then click Check now. We look up the domain’s TXT records against public DNS resolvers; when the record matches, the domain flips to verified.

The TXT record

Add a TXT record at your domain apex — the host field is @ (some registrars want the bare domain, e.g. example.com). The value is exactly what the card shows, in this form:

nofait-sso-verification=<your-token>

Note

Copy the full value from the Domain Verification card — the <your-token> part is unique to your domain. Don’t add the record to a subdomain (like www) — it must be at the apex.

Adding the record at common registrars

The exact wording varies, but the steps are the same everywhere. In your DNS host’s control panel:

1. Open the DNS / DNS records / Zone editor for your domain.
2. Add a new record with Type = TXT.
3. Set Host / Name to @ (or leave blank / use the bare domain — see the table).
4. Set Value / Content to the full nofait-sso-verification=… string. If the panel requires quotes, wrap it in double quotes.
5. Leave TTL at the default and save.

Registrar	Where	Apex host field
Cloudflare	DNS → Records → Add record	Use the bare domain (shown as @)
GoDaddy	Domain → DNS → Records	@
Namecheap	Domain List → Manage → Advanced DNS	@
Google Domains / Squarespace	DNS → Custom records	Leave host blank or @
AWS Route 53	Hosted zone → Create record	Leave name blank (record name = zone apex)

Checking with “Check now”

After you save the record, return to the Domain Verification card and click Check now. Each check queries live DNS for your TXT records and compares them to your token.

Give DNS time to propagate

New TXT records can take anywhere from a few minutes up to 48 hours to propagate. If Check now reports the record wasn’t found, wait and try again. To avoid hammering DNS, checks are rate-limited to roughly one every 10 seconds per domain — if you check too quickly you’ll be asked to wait a few seconds.

Once verified, the domain stays verified — you don’t need to re-check it. Keep the TXT record in place; removing it doesn’t un-verify the domain, but leaving it avoids confusion.

“This domain is not available”

A domain can be verified by exactly one SSO connection across the whole platform. If you see a neutral domain unavailable message when claiming a domain, it’s already claimed by another connection (which may be another part of your own organization). For privacy we don’t disclose who holds it — contact support and we’ll help sort out ownership.