Verified domains

Verify an email domain before configuring SSO for it or provisioning members at that domain through SCIM. Organization owners and admins prove ownership with a DNS TXT record. On Sim Cloud, domain verification requires an Enterprise organization.

A verified domain authorizes your organization to use its identity provider for addresses on that domain. Each domain belongs to one organization; subdomains such as eng.acme.com must be verified separately from acme.com.

Verify a domain

Open Settings → Organization → Single sign-on → Domains. The Verified domains section is shared by sign-in and directory provisioning.

1. Enter the domain, for example acme.com, and select Add domain.
2. Copy the TXT host and value shown by Sim: _sim-challenge.acme.com and sim-domain-verification=….
3. Add that TXT record at your DNS provider. Keep existing records; the challenge uses its own host.
4. Select Verify. Sim looks up the record and marks the domain Verified when it matches.

DNS changes can take time to propagate. If verification fails, check the record name and value, then wait and retry. Keep the record published. Sim checks it when you select Verify; removing the DNS record does not automatically revoke a completed verification.

Domains configured for SSO before domain verification was introduced were preserved as verified by the migration. New claims require verification.

Remove a verified domain

Removing a domain in Sim stops new SSO sign-ins for that domain, including through an existing provider. SCIM can no longer create accounts or change an account's email to that domain until it is verified again. Existing sessions are not ended by domain removal.

Re-add and verify the domain to restore its ownership proof. Another organization cannot claim it while it remains verified for yours.

Self-hosted setup

Enable SSO to expose Domains in the single sign-on settings:

SSO_ENABLED=true
NEXT_PUBLIC_SSO_ENABLED=true

You can instead enable the enterprise suite with both ENTERPRISE_ENABLED=true and NEXT_PUBLIC_ENTERPRISE_ENABLED=true. Set the browser twin too: the login page's SSO entry point reads it before a workspace loads. See Self-hosted enterprise.

The older /workspace/<workspaceId>/settings/domains path still resolves to Single sign-on → Domains.

Restricted networks

The application server queries 1.1.1.1 and 8.8.8.8 directly. Allow outbound DNS on UDP and TCP port 53 to both addresses. Verification uses public DNS, not the server's local resolver or an HTTP proxy.

Publish the TXT record in a publicly delegated zone. Private zones, including Route 53 private hosted zones, are not visible to these resolvers.

Skip DNS verification

Set the server-only variable and restart the application:

SSO_SKIP_DOMAIN_VERIFICATION=true

Under Domains, add the domain and select Verify. No TXT record or DNS access is needed. Sim records the domain as verified for SSO account linking and SCIM provisioning; another organization still cannot claim it. Existing pending domains can be verified the same way.

For Helm, the application image must support this variable. Updating the chart alone does not add support to an older image. Override app.image.tag with a compatible released image or your own build, and set app.image.repository if using a custom repository:

app:
  image:
    tag: "<image-tag-with-domain-verification-bypass>"
  env:
    SSO_SKIP_DOMAIN_VERIFICATION: "true"

If app.image.digest is set, replace it with a compatible digest instead; it takes precedence over the tag.

Removing the variable or setting it to false restores DNS verification for pending and future claims. Already verified domains stay verified. Remove a domain in Domains to revoke its trust.

Related docs

• Single sign-on
• Directory provisioning