# Verified domains (/platform/enterprise/verified-domains)





Verify an email domain before configuring SSO for it or provisioning members at that domain through SCIM. Organization owners and admins prove ownership with a DNS TXT record. On Sim Cloud, domain verification requires an Enterprise organization.

A verified domain authorizes your organization to use its identity provider for addresses on that domain. Each domain belongs to one organization; subdomains such as `eng.acme.com` must be verified separately from `acme.com`.

## Verify a domain [#verify-a-domain]

Open **Settings → Organization → Single sign-on → Domains**. The **Verified domains** section is shared by sign-in and directory provisioning.

<Image src="/static/enterprise/sso-domains.png" alt="Domains tab showing a verified domain and the DNS record for a pending domain" width="832" height="663" className="mx-auto h-auto w-full max-w-xl" />

1. Enter the domain, for example `acme.com`, and select **Add domain**.
2. Copy the TXT host and value shown by Sim: `_sim-challenge.acme.com` and `sim-domain-verification=…`.
3. Add that TXT record at your DNS provider. Keep existing records; the challenge uses its own host.
4. Select **Verify**. Sim looks up the record and marks the domain **Verified** when it matches.

<Callout type="warn">
  Some DNS providers append the zone automatically. In the `acme.com` zone, use `_sim-challenge` if your provider adds the zone, or `_sim-challenge.eng` for `eng.acme.com`. The resulting name must match Sim's full host, without a repeated suffix such as `_sim-challenge.acme.com.acme.com`.
</Callout>

DNS changes can take time to propagate. If verification fails, check the record name and value, then wait and retry. Keep the record published. Sim checks it when you select **Verify**; removing the DNS record does not automatically revoke a completed verification.

Domains configured for SSO before domain verification was introduced were preserved as verified by the migration. New claims require verification.

## Remove a verified domain [#remove-a-verified-domain]

Removing a domain in Sim stops new SSO sign-ins for that domain, including through an existing provider. SCIM can no longer create accounts or change an account's email to that domain until it is verified again. Existing sessions are not ended by domain removal.

Re-add and verify the domain to restore its ownership proof. Another organization cannot claim it while it remains verified for yours.

## Self-hosted setup [#self-hosted-setup]

Enable SSO to expose **Domains** in the single sign-on settings:

```bash
SSO_ENABLED=true
NEXT_PUBLIC_SSO_ENABLED=true
```

You can instead enable the enterprise suite with both `ENTERPRISE_ENABLED=true` and `NEXT_PUBLIC_ENTERPRISE_ENABLED=true`. Set the browser twin too: the login page's SSO entry point reads it before a workspace loads. See [Self-hosted enterprise](/platform/enterprise/self-hosted).

The older `/workspace/<workspaceId>/settings/domains` path still resolves to **Single sign-on → Domains**.

### Restricted networks [#restricted-networks]

The application server queries `1.1.1.1` and `8.8.8.8` directly. Allow outbound DNS on UDP and TCP port 53 to both addresses. Verification uses public DNS, not the server's local resolver or an HTTP proxy.

Publish the TXT record in a publicly delegated zone. Private zones, including Route 53 private hosted zones, are not visible to these resolvers.

### Skip DNS verification [#skip-dns-verification]

<Callout type="warn">
  This option delegates domain-claim authority to every organization owner and admin in the self-hosted instance. They can authorize an identity provider for any unclaimed email domain without proving ownership. Enable it only when the operator trusts those administrators to make that decision. It is off by default and ignored on Sim Cloud.
</Callout>

Set the server-only variable and restart the application:

```bash
SSO_SKIP_DOMAIN_VERIFICATION=true
```

Under **Domains**, add the domain and select **Verify**. No TXT record or DNS access is needed. Sim records the domain as verified for SSO account linking and SCIM provisioning; another organization still cannot claim it. Existing pending domains can be verified the same way.

For Helm, the application image must support this variable. Updating the chart alone does not add support to an older image. Override `app.image.tag` with a compatible released image or your own build, and set `app.image.repository` if using a custom repository:

```yaml
app:
  image:
    tag: "<image-tag-with-domain-verification-bypass>"
  env:
    SSO_SKIP_DOMAIN_VERIFICATION: "true"
```

If `app.image.digest` is set, replace it with a compatible digest instead; it takes precedence over the tag.

Removing the variable or setting it to `false` restores DNS verification for pending and future claims. Already verified domains stay verified. Remove a domain in **Domains** to revoke its trust.

## Related docs [#related-docs]

* [Single sign-on](/platform/enterprise/sso)
* [Directory provisioning](/platform/enterprise/scim)