# Verified domains for organization onboarding
## What it does
You prove ownership of a domain (for example acme.com) with a DNS record.
After that, users signing up with a matching email can be automatically
invited to the org or shown a suggestion to join, depending on the
enrollment mode you pick. No identity provider involved.
## The order
1. Add the domain to the organization and complete the DNS verification
(a TXT record at the host Clerk shows you). Until verification passes,
nothing below activates.
2. Pick the enrollment mode:
- Automatic invitation: matching users are invited (and join) with no
extra step.
- Automatic suggestion: matching users see the org suggested at sign-up
and choose to join.
3. Confirm which role new members get. Verified-domain enrollment uses the
organization's Default Role, so set the default role deliberately before
turning this on. An admin default here is a company-wide privilege
escalation.
4. Managing domains needs the manage domains system permission
(org:sys_domains:manage).
## SSO vs verified domains
- Enterprise SSO: the customer's IdP mandates authentication. Needs a SAML
or OIDC connection, an ACS URL, entity ID, and IdP metadata.
- Verified domains: proof of domain ownership only, for auto-invite and
auto-suggest flows with no SSO.
- A single domain cannot be both for the same organization. If the customer
later mandates SSO, migrate the domain off verified-domains mode as part
of the SSO rollout, not as an afterthought.
## Checklist
- DNS verification is per domain per org. A subdomain is a different
domain for verification purposes.
- Remove the domain when the customer churns. A verified domain on a dead
org keeps auto-inviting people into nowhere.