Verified Domains let organization owners and admins on Enterprise plans prove they control an email domain (like acme.com) with a DNS TXT record. Verifying a domain is the security precondition for configuring single sign-on for it.
Configuring SSO for a domain requires it to be verified first. Verifying proves your organization controls the domain — without it, anyone could point another company's domain at their own identity provider. Domains you had already configured for SSO are automatically treated as verified.
Verify a domain
Go to Settings → Security → Verified domains in your organization settings.
- Enter the domain, for example
acme.com, and click Add domain. - Sim shows a DNS TXT record to publish — a host (
_sim-challenge.acme.com) and a unique value (sim-domain-verification=…). - Add that TXT record at your DNS provider.
- Click Verify. Sim looks up the record; on success the domain is marked Verified.
Some DNS providers — GoDaddy, Namecheap, Hover, and most cPanel panels — append your zone to whatever you type in the host field. If yours does, enter the host with the trailing zone removed, or you will end up with _sim-challenge.acme.com.acme.com and verification will never succeed. Managing the acme.com zone, _sim-challenge.acme.com becomes _sim-challenge; verifying the subdomain eng.acme.com from that same zone, _sim-challenge.eng.acme.com becomes _sim-challenge.eng. Cloudflare and Route 53 take the full host as shown.
DNS changes can take up to 48 hours to propagate — if verification does not succeed immediately, wait and retry. Keep the TXT record published: leaving it in place means the domain stays verifiable if you ever need to verify it again.
Add each domain you own separately. Subdomains (eng.acme.com) are verified independently of the apex.