> ## Documentation Index
> Fetch the complete documentation index at: https://docs.krea.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Verification & Capture

> Verify ownership of your email domain to enable enterprise features like Domain Capture and SAML SSO for your Krea workspace.

Domain verification proves that your organization owns the email domain used by your team members. This is a prerequisite for enabling SAML Single Sign-On (SSO) and other enterprise security features.

<Note>
  Domain verification is required before you can configure SAML SSO. Complete these steps first, then proceed to [SAML SSO Setup](/user-guide/help-and-support/saml-sso-setup).
</Note>

<Tip>
  Verified domains default to **Enforced (Auto-Enroll)** for [Domain Capture](#configure-domain-capture), meaning users with matching email addresses will be automatically added to your workspace on their next login. Review the capture mode immediately after verifying your domain.
</Tip>

## Prerequisites

<CardGroup cols={2}>
  <Card title="Workspace Role" icon="user-shield">
    You must be a **workspace owner** or **admin**
  </Card>

  <Card title="DNS Access" icon="globe">
    Access to your organization's DNS settings (Cloudflare, Route 53, GoDaddy, etc.)
  </Card>
</CardGroup>

## Why Verify Your Domain?

Domain verification ensures that only authorized administrators can:

* Configure Domain Capture to automatically invite or enroll users with your domain
* Enable SAML SSO for users with your company email domain
* Manage authentication settings for your organization
* Control how team members access your Krea workspace

## Step 1: Add Your Domain

<Steps>
  <Step title="Open Workspace Settings">
    Navigate to [Workspace Settings ↗](https://www.krea.ai/settings/workspace-settings).

    You can also click your **workspace avatar** in the bottom-left corner of the sidebar, then select **Settings**.
  </Step>

  <Step title="Find Domain Management">
    Scroll down to the **Domain Management** section.

    ![Domain Management section](https://s.krea.ai/docs/sso-domain-management.png)
  </Step>

  <Step title="Add Your Domain">
    Type your company's email domain (e.g., `acme.com`) in the input field and click **Add Domain**.
  </Step>
</Steps>

<Tip>
  Use the domain portion of your employees' email addresses. For example, if employees use `user@acme.com`, enter `acme.com`.
</Tip>

## Step 2: Add DNS TXT Record

After adding your domain, Krea displays a verification token. Your domain will show as **Pending** until verified.

![Verification token](https://s.krea.ai/docs/sso-verification-token.png)

You'll see:

* A success alert with the **verification token** (starting with `krea-verification=`)
* Your domain listed with a **Pending** status
* A copyable TXT record value

<Warning>
  **Copy the token exactly** — including any special characters. Even a small typo will cause verification to fail.
</Warning>

### DNS Record Details

| Field         | Value                                                |
| ------------- | ---------------------------------------------------- |
| Type          | `TXT`                                                |
| Host/Name     | `@` (or leave blank, depending on your DNS provider) |
| Content/Value | The verification token shown in the modal            |
| TTL           | `3600` (1 hour) or your provider's default           |

### Adding the Record by Provider

<Tabs>
  <Tab title="Cloudflare">
    1. Log in to [Cloudflare Dashboard](https://dash.cloudflare.com)
    2. Select your domain
    3. Click **DNS** in the left sidebar
    4. Click **Add record**
    5. Set Type to `TXT`, Name to `@`, and paste the token in Content
    6. Click **Save**

    <Info>
      Reference: [Cloudflare DNS Documentation ↗](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/)
    </Info>
  </Tab>

  <Tab title="AWS Route 53">
    1. Open the [Route 53 Console](https://console.aws.amazon.com/route53)
    2. Click **Hosted zones** → Select your domain
    3. Click **Create record**
    4. Leave Record name empty, set Type to `TXT`
    5. Paste the token in Value (with quotes)
    6. Click **Create records**

    <Info>
      Reference: [AWS Route 53 Documentation ↗](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html)
    </Info>
  </Tab>

  <Tab title="GoDaddy">
    1. Log in to [GoDaddy](https://godaddy.com) → **My Products**
    2. Find your domain → Click **DNS**
    3. Click **Add** under Records
    4. Select Type `TXT`, Host `@`, paste token in TXT Value
    5. Click **Save**

    <Info>
      Reference: [GoDaddy Help - Add a TXT Record ↗](https://www.godaddy.com/help/add-a-txt-record-19232)
    </Info>
  </Tab>

  <Tab title="Namecheap">
    1. Log in to [Namecheap](https://namecheap.com) → **Domain List**
    2. Click **Manage** next to your domain
    3. Go to **Advanced DNS** tab
    4. Click **Add New Record**
    5. Select `TXT Record`, Host `@`, paste token in Value
    6. Click **Save All Changes**

    <Info>
      Reference: [Namecheap Knowledge Base - TXT Records ↗](https://www.namecheap.com/support/knowledgebase/article.aspx/317/2237/how-do-i-add-txtspfdkimdmarc-records-for-my-domain/)
    </Info>
  </Tab>

  <Tab title="Google Domains">
    1. Log in to [Google Domains](https://domains.google.com)
    2. Select your domain
    3. Click **DNS** in the left menu
    4. Scroll to **Custom records** → Click **Manage custom records**
    5. Click **Create new record**
    6. Set Type to `TXT`, Host name to `@`, paste the token in Data
    7. Click **Save**

    <Info>
      Reference: [Google Workspace Admin Help - TXT Records ↗](https://support.google.com/a/answer/2716800)
    </Info>
  </Tab>

  <Tab title="Other Providers">
    1. Log in to your DNS provider's dashboard
    2. Navigate to DNS settings for your domain
    3. Add a new TXT record
    4. Set the host/name to `@` (or leave blank)
    5. Paste the verification token as the value
    6. Save your changes
  </Tab>
</Tabs>

## Step 3: Verify Your Domain

<Steps>
  <Step title="Return to Krea">
    Go back to the verification modal in Krea.
  </Step>

  <Step title="Click Verify Domain">
    Click the **Verify Domain** button.
  </Step>

  <Step title="Wait for Confirmation">
    Krea will check your DNS records. Once verified, you'll see a success message.
  </Step>
</Steps>

<Info>
  **DNS propagation** can take anywhere from a few minutes to 72 hours. If verification fails, wait 5-10 minutes and try again.
</Info>

## Configure Domain Capture

Domain Capture controls what happens when a user with a matching verified email domain signs in to Krea. You can automatically add them to your workspace, prompt them to join, or take no action.

### Capture Modes

| Mode         | Label in Settings   | Behavior                                                                                                                                                    |
| ------------ | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Off**      | Disabled            | Users join only via direct admin invitation.                                                                                                                |
| **Optional** | Auto-Invite Enabled | Users see a "Join Your Verified Workspace" modal. They can accept or dismiss it (re-prompted after 1 week).                                                 |
| **Enforced** | Auto-Enroll Enabled | Users are automatically added to your workspace on next login. Their active workspace switches automatically and they see a confirmation modal. No opt-out. |

<Warning>
  **Default behavior:** Newly verified domains default to **Enforced (Auto-Enroll)**, meaning users with matching email domains will be automatically added to your workspace. Review and adjust the capture mode immediately after verifying a domain if this is not your desired behavior.
</Warning>

### Setting the Capture Mode

<Steps>
  <Step title="Open Domain Management">
    Navigate to [Workspace Settings ↗](https://www.krea.ai/settings/workspace-settings) and scroll to the **Domain Management** section.
  </Step>

  <Step title="Locate your verified domain">
    Find the domain you verified. Note that it defaults to **Enforced (Auto-Enroll)** immediately after verification.

    ![Domain capture mode picker](https://s.krea.ai/docs/domain-capture-management.png)
  </Step>

  <Step title="Select a capture mode">
    Use the radio buttons to choose **Off**, **Optional (Auto-Invite)**, or **Enforced (Auto-Enroll)**. Your selection is saved automatically.
  </Step>
</Steps>

### Key Details

<AccordionGroup>
  <Accordion title="Multiple workspaces with the same domain">
    Multiple workspaces can verify the same email domain. Each workspace manages its own capture mode independently. A user matching multiple workspaces may be enrolled or prompted for each one.
  </Accordion>

  <Accordion title="Existing workspace members">
    Users who are already members of your workspace are not affected by Domain Capture. No duplicate invitations or enrollment actions occur.
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="DNS record not found">
    * **Wait for propagation** — DNS changes can take up to 72 hours (usually under 1 hour)
    * **Verify your record** — Use [MXToolbox TXT Lookup](https://mxtoolbox.com/TXTLookup.aspx) to check if the record is visible
    * **Check for typos** — Ensure the verification token is copied exactly
    * **Check the host field** — Some providers want `@`, others want it blank, and some want your domain name
  </Accordion>

  <Accordion title="Record exists but verification still fails">
    * **Check for duplicate records** — Remove any old or duplicate TXT records
    * **Verify the exact value** — Some providers add quotes automatically; don't add extra quotes
    * **Try a different TTL** — Lower TTL values (300 seconds) propagate faster
  </Accordion>

  <Accordion title="I don't have access to DNS settings">
    Contact your IT administrator or the person who manages your organization's domain. They'll need to add the TXT record for you.
  </Accordion>
</AccordionGroup>

## Next Steps

Once your domain is verified and Domain Capture is configured, you can proceed to set up SAML SSO for centralized authentication:

<Card title="SAML SSO Setup" icon="key" href="/user-guide/help-and-support/saml-sso-setup">
  Configure Single Sign-On for your Krea Enterprise workspace
</Card>