> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add SSO domains

> Claim the email domains your people use and prove you control them with a DNS TXT record.

SSO applies to people by email domain, so each domain must be verified before its people can use your connection. You need to be an **owner** or **admin**, and able to add a DNS record for the domain.

## Claim a domain

> [tab] Dashboard
>
> **Step 1**
>
> ### Open Claim domain
>
> Go to [**Settings > Single sign-on**](https://app.sazabi.com/settings/single-sign-on) and, under **Domains**, choose **Claim domain**.
>
> **Step 2**
>
> ### Claim the domain
>
> Enter the domain, such as `example.com`, and choose **Claim**. The domain appears in the list with a **Pending** status, its TXT record open under the row.

> [tab] CLI
>
> Install and authenticate the CLI per [`/reference/cli`](https://docs.sazabi.com/reference/cli).
>
> ```bash theme={"system"}
> sazabi sso domains claim example.com    # Claim a domain and print its TXT record
> sazabi sso domains list                 # List claimed domains and their status
> ```

Matching is exact: `example.com` doesn't cover `eu.example.com`, so claim each subdomain your people's addresses use. Shared email domains, such as `gmail.com`, can't be claimed. Several organizations can hold a pending claim on the same domain; the first to verify it holds it, and no other organization can verify it after that.

To manage domains with Terraform, use [`sazabi_sso_domain`](https://docs.sazabi.com/reference/terraform/sazabi_sso_domain) and [`sazabi_sso_domain_verification`](https://docs.sazabi.com/reference/terraform/sazabi_sso_domain_verification).

## Publish the TXT record

Add this record at your DNS provider. Copy the name and value from the domain's row (choose **Record** to show them), or from the CLI's output; the value is unique to your claim.

| Type | Name | Value |
| - | - | - |
| `TXT` | `_sazabi-verification.example.com` | `sazabi-domain-verification=` followed by the domain's token |

Leave the record in place after the domain is verified.

## Keep the domain verified

Sazabi keeps checking verified domains:

* A lookup error, such as a timeout, never counts against a domain.
* If the record is definitely missing on several checks in a row, the domain becomes **Lapsed**. A lapsed domain is still held by your organization, and its SSO keeps working.
* Publish the record again to restore it. If it stays missing past the grace period, the domain returns to **Pending**, and another organization could verify it.

To remove a domain, choose **Remove** on its row, or run `sazabi sso domains remove example.com`. A domain that requires SSO can't be removed; turn enforcement off first.

## Verify the domain

Once the record is published, choose **Verify** on the domain's row, or run:

```bash theme={"system"}
sazabi sso domains verify example.com
```

The domain shows **Verified** when Sazabi finds the record. If it isn't found yet, the row says so and shows when it last checked; DNS may still be updating, so try again later. A DNS lookup error is reported separately and never changes the domain's status. A missing record leaves a pending claim pending. For a domain that's already verified or lapsed, a check counts like Sazabi's own checks: if the record has been missing long enough, the domain becomes **Lapsed** or returns to **Pending**, and returning to **Pending** also turns enforcement off.

## Further reading

> [card] [Configure SSO](https://docs.sazabi.com/guides/administer/single-sign-on/setup.md)
>
> Connect your identity provider next.

> [card] [Troubleshooting SSO](https://docs.sazabi.com/guides/administer/single-sign-on/troubleshooting.md)
>
> Fix domain verification failures.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.