Domains
How a company gains authority over accounts in its own domains.
An organization can own one domain or a group of them. Ownership is proven through DNS, because otherwise declaring yourself the owner of somebody else's mail domain would be enough.
Verification
Add the domain on the organization's page in the console. You get a record to publish in DNS:
name: _authmy.company.com
value: authmy-org-verification=abc123…
Type TXT. Once published, press "Verify".
A record on the domain itself with the old value authmy-verification=…
still counts: domains verified before the record moved keep working, and
so does a setup started by the earlier instructions.
Public mail domains — gmail.com, outlook.com and the like — cannot be claimed with any TXT record.
What changes after verification
New addresses in the domain create organization accounts. Someone signing
in for the first time as [email protected] becomes an employee immediately:
no invitation is needed, the "Sign in with auth.my" button on your site is
the entry point.
Existing accounts transfer to the organization. If an address in the domain was already in use, that account becomes an organization account.
Secondary addresses in the domain are detached. If someone added
[email protected] as a second address on their personal account before the
company verified the domain, that address is detached and moves under
organization control.
Their console keeps a history entry about it, but the address itself is removed: leaving it active would mean one address signing in to two different accounts.
Domain groups
A company may own several domains: company.com, company.io,
company-group.net. That is one organization, and joining it once grants
access to all of its applications across every domain in the group.
For employees this happens by itself. External members are shown the full list of domains, and consent covers the group as a whole — partial consent does not exist.
Address rules
| Who | What they may add |
|---|---|
| ordinary user | any address, except domains owned by other organizations |
| organization member | only addresses in their own organization's domains |
The second rule is deliberately strict: the organization controls the account, and a personal address inside it would mean access survives the person leaving.