Verified Domains

By default, the first time a provisioned user signs in via SSO, they complete a one-time email verification code, proving they own that mailbox before it's linked to their Starhive account. Verifying a domain removes that step for everyone whose email is at that domain — they're linked automatically and sign straight in.

Domain verification works by proving control of the domain's DNS. It's enabled per workspace on request, alongside SCIM provisioning, and requires a configured Single Sign-On connection.

Add and verify a domain

1. Workspace settings → Single Sign-On → Verified domains.
2. Add a domain you own, e.g. example.com.
3. Starhive shows a DNS TXT record value: starhive-domain-verification=<token>.
4. Add that value as a TXT record on that exact domain with your DNS provider.
5. Back in Starhive, click Verify.

DNS changes can take a few minutes to propagate — if verification fails immediately, wait and retry.

Matching is exact per domain

A TXT record on example.com verifies example.com only, not mail.example.com or any other subdomain — add and verify each domain your users' emails actually use. You can verify multiple domains.

How sign-in behaves

Situation	Result
Provisioned user, domain verified	Linked automatically, no code.
Provisioned user, domain not verified	One-time email code, then linked.
Had a Starhive account before being provisioned, domain verified	Also linked automatically.
Not provisioned (invited manually)	The one-time code still applies, regardless of domain verification.

Domain verification is a convenience, not an access grant — it never lets anyone into your workspace on its own; access always comes from provisioning or an invitation.

Troubleshooting

Symptom	Likely cause / fix
Verify fails although the TXT record exists	The record must be on the exact domain (not a subdomain or parent), the value must match exactly, and DNS may still be propagating.
A provisioned user is still asked for an email code	Their domain isn't on the verified list yet, or verification hasn't completed.
Domains show unverified after replacing the SSO configuration	Verified domains belong to a specific SSO configuration — re-add and re-verify them on a new one.