Verify your email domain for single sign-on

Before your team can sign in through your company login, prove that your firm owns its email domain, such as smithlaw.com, by adding a TXT record to the domain's DNS. This is the first step of single sign-onSingle sign-on (SSO) Signing in through your firm's own company login instead of a sign-in code, set up for your email domain on the Enterprise plan., and only an Admin of a hubHub Your law firm's own client portal, with its branding, its team and all of its cases in one place. on the Enterprise plan can take it.

1. 1

   Open Domains

   Go to Domains: on the Hubs page, choose Domains, beside Create Hub. It shows only if you're an Admin of a hub on the Enterprise plan.

2. 2

   Add your domain

   Choose New. In Create Domain, pick your hub under Select enterprise app, type your email domain under Domain name, such as smithlaw.com, and choose Add. The domain shows on the Pending tab.

3. 3

   Copy its TXT value

   On Pending, copy the domain's Txt Value with the copy icon beside it. It's caseactive-verification= followed by 50 letters and digits.

4. 4

   Add the TXT record

   In your DNS provider, add a TXT record on the domain itself, whose host is usually @ or left blank, with the whole value exactly as you copied it. Other TXT records on the domain can stay.

5. 5

   Wait for Active

   The first check runs 15 minutes after you added the domain, then every hour. Once the record matches, the domain moves to the Active tab. Nobody is emailed, so look there.

What happens next

Next, connect your company login.

• Each email domain your staff use needs verifying on its own. A subdomain, such as mail.smithlaw.com, is a separate domain.
• Nothing checks the record again once the domain is Active.
• A domain belongs to the person who added it: only they see it on their Domains page and can change it. If they leave, another Admin of an Enterprise hub adds and verifies the same domain, and it moves to their page with its single sign-on settings. Whoever had it is emailed, naming who verified it and for which hub.
• Delete, in a domain's Action menu, removes it. Deleting an Active domain ends single sign-on for it and discards its settings.
• If the hub leaves the Enterprise plan, the domain is kept, its people get sign-in codes again, and single sign-on stops until the hub is back on Enterprise. Deleting the hub releases the domain once its 30 days have passed.

If something goes wrong

• "Only an Admin of a hub on the Enterprise plan can set up single sign-on." You aren't an Admin of the hub you picked, or it isn't on Enterprise. See Change your plan.
• "No enterprise app found": none of your hubs is on the Enterprise plan.
• "Domain is invalid. Example: example.com": type the domain on its own, without an @ or anything before it.
• Still Pending after a few hours. Check that the record is on the domain itself, not on a subdomain, and holds the whole value. DNS changes can take a while to spread. A domain still pending after about two days is dropped: add it again, and put its new value in the TXT record.