Verified domains

Proving that your organization controls a domain unlocks the features that need to trust a name: the “Verified · your-domain.com” mark on registries, automatic sign-in routing for your enterprise SSO connection, and invite auto-accept for your own employees. The proof asserts “controlled by whoever controls this domain”, nothing more; it is re-checked regularly, and everything that depends on it switches off while the proof does not hold.

Claiming a domain

Claim a domain on your organization’s Domains tab (owners only). The claim mints a challenge token and shows two ways to publish it; either one proves the claim.

DNS TXT record (the primary method): add a TXT record at _haven-challenge.your-domain.com with the value haven-domain-verification={token}. Other TXT records at the same name can stay; the check looks for any matching value.

Well-known file (the fallback): serve the token, one per line, as plain text at https://your-domain.com/.well-known/haven-domain-verification. This proves control of the site rather than the DNS zone, and the check follows no redirects.

Press Check now once the record is in place. Checks are also run regularly in the background, so a claim verifies on its own once the record propagates.

Domains are exact: a proof for acme.com says nothing about eu.acme.com, claim each name you use. Internationalized domains are stored and shown in their punycode form.

Lapse and recovery

The proof is re-checked on a schedule. If the record disappears and checks keep failing definitively, the proof lapses: the mark is hidden, SSO routing stops, and invite auto-accept stops, until a check succeeds again. Recovery is automatic; nothing has to be reconfigured. Network trouble and timeouts never count against you, only definite “the record is not there” answers do.

What verification unlocks

• The verified mark. Each registry’s settings can pin one of your proven domains; the registry then shows “Verified · your-domain.com” wherever it is listed. The mark names its evidence and renders only while the proof holds.
• SSO sign-in routing. An SSO connection that claims the domain starts routing matching emails from the shared sign-in page. Claims without a proof stay inert.
• Invite auto-accept. Pending invites to your organization auto-accept when the invited person signs in through your SSO connection asserting an email under the proven domain.