# Verify an email domain

> Verifying a domain proves your organization controls it. Once that's done, colleagues signing in with an address on that domain can ask to join you, and your…

Source: https://infranest.io/docs/verified-domains
Last updated: 2026-09-19

---

Verifying a domain proves your organization controls it, so colleagues on that domain can request to join and your sign-in connections can trust it automatically. This article is for anyone setting up domain verification in InfraNest.

## Overview

- Verification works by adding a one-off DNS record — nothing happens until it's in place.
- An unverified domain grants no access at all.
- Once verified, it can be used to let colleagues join your organization or to restrict sign-in to "our verified domains."

<!-- screenshot: verified-domains -->

<!-- docs-screenshots:start:verified-domains -->

![Verify an email domain](/media/74fece80-6b45-4a29-b704-aae25d7bb016)

<!-- docs-screenshots:end:verified-domains -->

## Verify a domain

1. Go to **Settings → Sign-in → Verified domains**.
2. Type the domain (for example `acme.com`) and choose **Add domain**.
3. You'll see the exact record to create:

   | | |
   |---|---|
   | **Type** | TXT |
   | **Host** | `_infranest-challenge.acme.com` |
   | **Value** | a code unique to you |

4. Create that record at whoever runs your DNS, then choose **Check now**.

> [!NOTE]
> DNS changes take a few minutes to spread, so "not found yet" on the first check is normal. We keep checking in the background and the domain flips to **Verified** on its own.

### If your DNS is already here

When the domain sits in a DNS zone you manage in InfraNest, you don't have to touch anything: the panel says so and offers **Add it for me**. We create the record and start checking.

If the zone is here but connected read-only, we'll say that too — add the record at your provider instead, or connect the provider so we can write to it.

## Invite colleagues who already have an account

Once a domain is verified, InfraNest can tell you how many people on it already have an account but aren't members of your organization. Choose **Invite them** and each gets a normal invitation to accept.

This is never automatic. Verifying a domain does not pull existing accounts into your organization, and it never moves anyone out of an organization they're already in.

## What a verified domain is used for

- **Joining.** Depending on your connection's setting, someone signing in with an address on the domain can request to join.
- **Restricting sign-in.** A connection can accept "our verified domains" instead of a list you maintain by hand.

Exact matches only: verifying `acme.com` does not cover `mail.acme.com`. Verify that separately if you need it.

## Keeping it verified

We re-check verified domains periodically. If the TXT record disappears, we don't drop the domain immediately — a single failed lookup is usually a DNS hiccup, not a lost domain. It's only withdrawn after the record has been missing for a while, and that's recorded in your **Audit Log**.

Leave the record in place. Its description in your DNS says the same.

## Remove a domain

1. Go to **Settings → Sign-in → Verified domains**.
2. Find the domain and choose **Remove**.

If we created the TXT record for you, we clean it up too. Anything you added by hand stays — we don't delete records we didn't create.

## Troubleshooting

**"That domain is already claimed."** A domain can belong to only one organization, so nobody can claim yours. If you believe it's yours, contact support.

**It never verifies.** Check the host is the full `_infranest-challenge.<your domain>` — some DNS providers add the domain automatically, which can produce a doubled name. Then confirm the value matches exactly.