Verify a domain for your workspace

Prove ownership of your company's email domain with a DNS record to unlock SSO, automatic user provisioning, SCIM, and branded app URLs.

<head> <script type=“application/ld+json”> {{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Do I need a verified domain to set up SSO?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Verifying a domain is the first step of SSO setup, and the SSO configuration flow walks you through it if you have not done it yet."}}, {"@type": "Question", "name": "Does domain verification expire?", "acceptedAnswer": {"@type": "Answer", "text": "No. RShift Sites checks the DNS record once, when you click Verify domain. A verified domain stays verified until you remove it from your workspace."}}, {"@type": "Question", "name": "Can I remove the TXT record after verification?", "acceptedAnswer": {"@type": "Answer", "text": "Verification is checked once, so removing the record does not un-verify the domain. Keeping the record in place is recommended so you can verify again easily if you ever remove and re-add the domain."}}, {"@type": "Question", "name": "Can two workspaces verify the same domain?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Verification proves ownership to a workspace. It does not claim the domain exclusively. If your organization runs several workspaces, each one verifies the domain separately and configures its own identity settings. Require SSO and Block workspace creation are domain-wide, so they apply to every workspace that has verified the domain and you only need to enable them once."}}, {"@type": "Question", "name": "What happens to members if I delete a verified domain?", "acceptedAnswer": {"@type": "Answer", "text": "Nothing immediately. Existing members keep their access and their sessions stay active. The domain stops working for SSO sign-in, and if it was your last verified domain, Enforce SSO and Verified email sign-up turn off automatically."}}, {"@type": "Question", "name": "Can I restrict sign-ups on my domain to SSO only?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Require SSO restricts account creation on a verified domain so new users must sign up through your SSO provider instead of email/password or social login. It applies domain-wide across all of RShift Sites and requires an SSO provider with SSO sign-in provisioning. Contact RShift Sites support to enable it for your domain. See Restrict a domain to SSO (domain lock) for how it fits with Enforce SSO and Block workspace creation."}}]}} </script> </head>

Verified domains let you prove to RShift Sites that your organization owns an email domain, such as acme.com. Verification happens once, through a DNS record, and unlocks the identity and provisioning features that depend on knowing which users belong to your company.

Once a domain is verified, RShift Sites can treat anyone signing in with an email on that domain (for example jane@acme.com) as a member of your organization, and apply your workspace’s authentication and provisioning rules to them.

Available on: Business and Enterprise plans
Access: Workspace admins and owners
Location: Identity (Settings → Access → Identity → Verified domains)

Why verify a domain

You need at least one verified domain before you can use most workspace identity features:

SSO: connect a SAML or OIDC identity provider for your workspace. See Set up workspace single sign-on (SSO).
Enforce SSO: require all workspace members to sign in through your identity provider.
Domain lock: combine Enforce SSO with the domain-wide Require SSO and Block workspace creation settings so everyone on the domain signs in through SSO and works only in your workspaces. Available on the Enterprise plan. See Restrict a domain to SSO (domain lock).
Verified email sign-up: automatically add users who sign up with an email on your verified domain to your workspace, with a default role you choose. No SSO needed.
SSO sign-in provisioning: automatically add users to your workspace the first time they sign in through your SSO provider.
Add existing users: a one-time action that adds existing RShift Sites users with verified-domain emails to your workspace.
SCIM provisioning: sync users and groups from your identity provider on the Enterprise plan. See Set up SCIM user provisioning.
Branded app URLs: publish apps under a workspace subdomain derived from your verified domain. See Publish apps with branded URLs.
External publish invites: restrict email invites to internally published apps to your company’s verified domains. See Who can receive external invites.

The provisioning options above are configured on the same Identity tab. See Manage workspace identity and user provisioning for how they work and interact.

Prerequisites

A workspace on the Business or Enterprise plan.
An owner or admin role in the workspace.
Access to your domain’s DNS settings (through your DNS provider, such as Cloudflare, GoDaddy, or AWS Route 53).

Verify a domain

Add your domain in RShift Sites

Go to Identity (Settings → Access → Identity), and under Verified domains, click Add domain. Enter your domain, for example acme.com. Wildcards are not supported.

Create the DNS TXT record

RShift Sites shows a DNS record to create. In your DNS provider, add a record with:

Setting	Value
Type	TXT
Host/Name	`@` (some providers want this blank, or want the domain name itself)
Value	The `lovable_verification=` token shown in the dialog, copied exactly

Wait for DNS propagation

DNS changes can take anywhere from a few minutes to 72 hours, though most providers apply them within minutes.

Verify the domain

Back in RShift Sites, click Verify domain.

How domain verification works

Verification is a one-time check. RShift Sites checks the DNS record when you click Verify domain. Verified domains do not expire and are not re-checked later.
You can verify multiple domains. Add each domain your organization uses, for example acme.com and acme.co.uk.
Verifying a domain does not reserve it. Another workspace can verify the same domain. If your organization runs several workspaces, each one verifies the domain separately.
Changes are audited. Adding and removing verified domains is recorded in your workspace audit logs.

Remove a verified domain

Go to Identity (Settings → Access → Identity).
In the Verified domains list, click the trash icon next to the domain.
Confirm in the Delete verified domain dialog.

Removing a domain does not remove existing workspace members or end their sessions. Users who already joined through that domain keep their access.

Troubleshooting

Could not find TXT record for domain

The DNS record is not visible to RShift Sites yet. This usually means one of:

The record has not propagated. DNS changes can take up to 72 hours, though minutes is typical. Wait and try again.
The record is on the wrong host. The TXT record must be on the root of the domain (@), not on a subdomain like www.
The value does not match. The value must be the full lovable_verification= token exactly as shown, with no extra characters or quotes added by your DNS provider.

Could not lookup TXT record for domain

RShift Sites could not query DNS for the domain at all. Check that the domain is spelled correctly and is a real, registered domain with active DNS.

The domain shows as already verified

The domain is already in your workspace’s verified list. You do not need to do anything.

FAQ

Do I need a verified domain to set up SSO?

Yes. Verifying a domain is the first step of SSO setup, and the SSO configuration flow walks you through it if you have not done it yet.

Does domain verification expire?

No. RShift Sites checks the DNS record once, when you click Verify domain. A verified domain stays verified until you remove it from your workspace.

Can I remove the TXT record after verification?

Verification is checked once, so removing the record does not un-verify the domain. Keeping the record in place is recommended so you can verify again easily if you ever remove and re-add the domain.

Can two workspaces verify the same domain?

Yes. Verification proves ownership to a workspace. It does not claim the domain exclusively. If your organization runs several workspaces, each one verifies the domain separately and configures its own identity settings. Require SSO and Block workspace creation are domain-wide, so they apply to every workspace that has verified the domain and you only need to enable them once.

What happens to members if I delete a verified domain?

Nothing immediately. Existing members keep their access and their sessions stay active. The domain stops working for SSO sign-in, and if it was your last verified domain, Enforce SSO and Verified email sign-up turn off automatically.

Can I restrict sign-ups on my domain to SSO only?

Yes. Require SSO restricts account creation on a verified domain so new users must sign up through your SSO provider instead of email/password or social login. It applies domain-wide across all of RShift Sites and requires an SSO provider with SSO sign-in provisioning. Contact RShift Sites support to enable it for your domain. See Restrict a domain to SSO (domain lock) for how it fits with Enforce SSO and Block workspace creation.