Clerk verified domains: auto-invite and auto-suggest without SSO

TL;DR: Verified domains are the lighter sibling of enterprise SSO: no IdP, just proof you own the domain, and then users with matching emails get invited or nudged automatically. Dont confuse the two or you will try to configure SAML where a DNS record would do. Add the domain to the organization and complete the DNS verification (a TXT record at the host Clerk shows you). Confirm which role new members get.

Verified domains for organization onboarding

What it does

You prove ownership of a domain (for example acme.com) with a DNS record. After that, users signing up with a matching email can be automatically invited to the org or shown a suggestion to join, depending on the enrollment mode you pick. No identity provider involved.

The order

1. Add the domain to the organization and complete the DNS verification (a TXT record at the host Clerk shows you). Until verification passes, nothing below activates.

2. Pick the enrollment mode:

   • Automatic invitation: matching users are invited (and join) with no extra step.

   • Automatic suggestion: matching users see the org suggested at sign-up and choose to join.

3. Confirm which role new members get. Verified-domain enrollment uses the organization's Default Role, so set the default role deliberately before turning this on. An admin default here is a company-wide privilege escalation.

4. Managing domains needs the manage domains system permission (org:sys_domains:manage).

SSO vs verified domains

• Enterprise SSO: the customer's IdP mandates authentication. Needs a SAML or OIDC connection, an ACS URL, entity ID, and IdP metadata.

• Verified domains: proof of domain ownership only, for auto-invite and auto-suggest flows with no SSO.

• A single domain cannot be both for the same organization. If the customer later mandates SSO, migrate the domain off verified-domains mode as part of the SSO rollout, not as an afterthought.

Checklist

• DNS verification is per domain per org. A subdomain is a different domain for verification purposes.

• Remove the domain when the customer churns. A verified domain on a dead org keeps auto-inviting people into nowhere.

When to use this

• This covers exactly what the title says: Clerk verified domains.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Clerk; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Clerk behavior.

Verified against Clerk's organization membership model: verified domains require DNS ownership proof, offer automatic invitation and suggestion enrollment modes, use the org default role for new members, and cannot share a domain with enterprise SSO for the same org.