Domain verification overview

Domain verification is how your organization proves to BreezeAuth that it owns an e-mail domain, such as example.com. You prove it by adding a small text record to the domain’s DNS settings, something only the domain’s owner can do.

Verifying a domain is one of the most important steps when setting up BreezeAuth. It is what allows your organization to take control of the accounts of the people who work for it: everyone with an @example.com e-mail address becomes a managed user of your organization.

Domains are managed under Organization › Domains in the admin console.

Why verify a domain

Without a verified domain, every person in your organization is a guest: their BreezeAuth account belongs to them, not to you. You can give them access to applications, but most of your organization’s security controls don’t apply to them.

Once you verify your domain, the people whose e-mail is on it become managed users, and you can:

• Create accounts directly. Add a person with an initial password and they can sign in right away, without having to accept an invitation.
• Apply your security policies. Your password, multi-factor authentication (MFA) and session policies apply only to managed users.
• Control the whole account lifecycle. Reset passwords, force password updates, end active sessions and deactivate accounts when someone leaves.
• Prevent shadow accounts. Nobody can create a personal BreezeAuth account with an e-mail address on your verified domain. Only your organization can create them.

See Managed and guest users for the details.

How it works

1. Add the domainIn Organization › Domains, enter the domain, such as example.com.
2. Publish a DNS recordWhoever manages the domain adds a TXT record with the value BreezeAuth shows you.
3. Start verificationBreezeAuth looks up the domain's DNS and checks that the record is there.
4. Users become managedAccounts with an e-mail on the domain are now managed by your organization.

Step-by-step instructions are in Add and verify a domain.

Key facts at a glance

Topic	Behavior
Proof of ownership	A DNS TXT record on the domain itself, with a value unique to your organization’s domain entry.
Who can do it	Owner and Administrator can add, verify and delete domains. Auditor can view them.
One owner	A domain can be verified by only one organization. Once verified, other organizations can no longer add it.
Exact match	Only the exact domain is covered. Verifying example.com does not cover sales.example.com: add and verify each domain your e-mails use.
How many	An organization can verify as many domains as it needs, for example example.com and example.com.br.
When it’s checked	Only when you select Start verification. BreezeAuth doesn’t check the record again afterwards.
Effect on accounts	Every BreezeAuth account with an e-mail on the domain becomes managed by your organization. Some may need your review before they can sign in.
Self sign-up	Blocked for e-mail addresses on a verified domain.
Monitoring	Changes are recorded in the Audit Logs and can be sent to your systems with webhooks.

Before you start

• Know who manages your DNS. You need someone who can add records to the domain’s DNS zone, usually your IT team or the company where the domain is registered or hosted (your registrar, Cloudflare, AWS Route 53, GoDaddy, Registro.br and so on).
• List the domains your people use. Check which domains appear after the @ in your colleagues’ e-mail addresses. Each one needs to be verified separately.
• Plan for existing accounts. People on the domain who already have a BreezeAuth account but aren’t active members of your organization will need your review after verification. See What happens to existing accounts.

Next steps

• Add and verify a domain in the admin console.
• Learn the differences between managed and guest users.