Domains

DNS-TXT verified domains — the tenancy gate. One domain maps to one org.

Two independent proofs gate every org

The hd claim on the employee's silently-obtained Google token proves they work there; the DNS-TXT record proves you're authorized for the org. A domain maps to exactly one org. No capture flows for a domain until verified_at is set.

Verified domains