Domain verification

Prove you control your e-mail domain with one DNS TXT record. Verification unlocks auto-join and protects the domain from personal-Google sign-ins.

What you need

  • Owner or admin role in the organization.
  • Access to the DNS zone of the domain (your registrar or DNS host: Cloudflare, Route 53, Google Domains, cPanel …), or someone who can add one record for you.

Steps

  1. Add the domain

    Organization → Sign-in & domains → Add domain. Enter the bare domain your people use in e-mail, for example acme.com. Subdomains (corp.acme.com) are separate domains and need their own record.

  2. Copy the record OKY shows you

    OKY generates a unique token for this domain. Create a TXT record at the host _oky (so the full name is _oky.acme.com) with the value oky-verify=<token>. Example:

    Record type
    TXT
    Host / name
    _oky
    Full name
    _oky.acme.com
    Value
    oky-verify=k7Qm3xw9ZpR2vT8nLc4bH1sD
    TTL
    3600 (or your DNS host's default)

    Use the token from your dashboard — the one above is only an example. Some DNS hosts want the full name _oky.acme.com in the host field, others want just _oky; both end up as the same record.

  3. Click “Verify”

    Back in OKY, press Verify now. OKY looks up the TXT record and, if the token matches, marks the domain Verified with a timestamp.

How long it takes

  • Most DNS hosts publish a new TXT record within a minute; some take up to an hour. If Verify now fails, wait a few minutes and try again.
  • You can check from any machine: dig TXT _oky.acme.com +short or nslookup -type=TXT _oky.acme.com should print "oky-verify=…".
  • OKY re-checks verified domains nightly. Leave the record in place: if it disappears, the domain drops back to unverified and auto-join pauses until it is restored.

What a verified domain unlocks

CapabilityUnverifiedVerified
Invitations to addresses on the domain✓✓
Work e-mail code sign-in for invited members✓✓
Auto-join: anyone @domain becomes an employee—✓
Personal Google sign-in refused for @domain—✓
Linking an existing personal account by address—✓
SSO for the domain (routing to your identity provider)—✓

In short: an invite proves intent for one address, so it works either way. Anything that applies to everyone on the domain needs proof that the domain is yours.

Rules

  • Consumer domains (gmail.com, googlemail.com, outlook.com, hotmail.com, yahoo.com, icloud.com, proton.me, mail.ru, yandex.ru and similar) can never be organization domains.
  • A domain belongs to one organization at a time.
  • You can add several domains (acme.com, acme.co.uk); each is verified separately.
  • Removing a domain does not remove members who joined through it — it stops new auto-joins and lifts the personal-Google refusal.

Troubleshooting

“Record not found”

The record has not propagated yet, or it was created at the wrong name. Confirm with dig TXT _oky.acme.com +short. A common slip is entering _oky.acme.com in a host field that already appends the domain, producing _oky.acme.com.acme.com.

“Token mismatch”

The TXT value exists but is not the token shown for this domain — usually copied from another domain or an older attempt. Copy the value again from Sign-in & domains and replace the record. Keep the oky-verify= prefix.

Verified yesterday, unverified today

The nightly re-check could not find the record. Someone may have cleaned up DNS. Restore the record and press Verify now; auto-join resumes immediately.

Our DNS is managed by another team

Send them the three values (type TXT, name _oky, value oky-verify=…) — nothing else changes in your zone. If a pilot cannot wait for DNS, OKY support can verify the domain manually after checking with you; write to support@oky.ai.