Security and domains

Verify ownership and configure domain restrictions independently.

Organization admins use Account settings → Security. Configuring domain security requires an eligible Pro or Enterprise plan.

Verify a domain

Select Verify a domain and follow the verification flow. You prove ownership by adding a DNS record; your DNS or IT administrator may need to help.

A verified domain confirms ownership. Verification alone does not invite users, grant workspace access, or enable either restriction below.

Restrict membership

After verification, select Enable restriction and choose the domains allowed for organization membership. Use Edit allowed domains to change an existing restriction.

Members must use a verified email address on an allowed domain. Before saving, remove members and revoke pending invitations outside your selected domains in Members. The app does not silently remove them for you.

A saved domain that is no longer verified must be verified again or removed from the allowed list before you save an updated restriction.

Turning the restriction off allows organization admins to invite people using other email domains. Your verified domains remain saved.

Restrict organization creation

Restrict organization creation prevents people using your verified domains from creating new organizations. It requires at least one verified domain.

Existing organizations are unaffected. This is independent of your organization’s membership restriction.

Plan changes

Existing restrictions can remain active after the organization loses eligibility to configure domain security. The app lets you turn them off; a downgrade should not be treated as automatic removal of your restrictions.

Access remains separate

Domain ownership and allowed email domains do not grant workspace or private-resource membership. Continue to use explicit invitations and resource access controls.

For verification problems or an unexpected restriction, email [e-mail].