Company domains and auto-join

Add a domain

1. Open Team → Domains and add your domain

   Enter the domain of your company email addresses, such as example.com. Public email providers (Gmail, Outlook, …), public suffixes and DNSPeek’s own domains are refused.

2. Signed in with your work email? It’s verified

   If your account has a verified email address on that domain (say, you@example.com), the domain is verified straight away and shows Verified by email. The address must be on the domain itself: you@eng.example.com can’t verify example.com by email. You don’t need access to your company’s DNS.

3. Turn on auto-join

   Choose how colleagues join (see below). New domains start with auto-join off.

If the domain stays Not verified, your account has no verified address on it. Either sign in with your work email (or add and confirm it in your account) and click Verify by email on the domain card, or lock the domain with DNS.

What email verification means

A domain verified by email stays verified as long as someone in charge of the workspace, the owner or an admin, has a verified email address on it. DNSPeek checks this every day.

If none of the owner and admins has such an address any more (for example, the admin who added the domain left the company and was removed), the domain shows Verification lost and auto-join pauses. The owner and admins get an email and a notification. An owner or admin with a verified work address clicks Verify by email to resume, or you can lock the domain with DNS.

Email verification is quick, but it isn’t exclusive: your company’s IT can still lock the domain with DNS in a workspace of their own, and that takes priority (see When a domain is superseded).

Lock the domain with DNS (optional)

Publishing a DNS record proves that the company itself controls the domain. A DNS lock is exclusive: no other workspace can claim the domain, not even someone with a company email. Use it when several teams of your company use DNSPeek, or when you want auto-join to always lead to the official workspace.

1. Open the domain card and expand Lock the domain with DNS (optional)

   The card shows the record to publish.

2. Publish the TXT record at your DNS provider

   Host:  _dnspeek-verify.example.com
   Type:  TXT
   Value: dnspeek-verify=<token shown in DNSPeek>

   Copy the exact values from the domain card. Some DNS panels want only _dnspeek-verify as the host name. If you don’t manage DNS yourself, send these three lines to whoever does.

3. Click Verify

   You must be signed in with a verified email address on that domain. If the record is not found yet, the card shows what DNSPeek found and what it expected; wait a few minutes and try again. When it works, the card shows Verified by DNS with a lock.

A domain is verified in one workspace at a time. If another workspace verified it by email, locking it with DNS here moves it to you. If another workspace locked it with DNS, it can’t be claimed until that lock is removed.

When a domain is superseded

If your workspace verified a domain by email and another workspace then locks the same domain with DNS, the DNS lock wins. Your domain card shows Superseded, auto-join stops in your workspace, and the owner and admins get an email and a notification. For privacy, DNSPeek doesn’t say which workspace locked it.

Nobody is removed: colleagues who already joined your workspace stay members, and everyone keeps their personal workspace and links. New colleagues join the workspace that holds the DNS lock instead.

If you believe the domain belongs with your workspace, talk to your company’s IT: whoever controls the DNS record decides. Once the other workspace removes its lock, you can verify the domain here again.

Choose how colleagues join

On the domain card pick:

• Join automatically: colleagues become members as soon as they sign in, with the Role for new members you choose (member or viewer). If no seat is free, a join request is created instead.
• Ask an admin to approve: each sign-in creates a join request. The owner and admins get an email and approve or reject it on Team → Members. A good choice if you want to check every newcomer.

Two more switches refine who qualifies:

• Include subdomains: also match addresses such as anna@eng.example.com.
• Require Google Workspace sign-in: only people who sign in with Google using the company’s Google Workspace account qualify.

Only people with a verified email address on the domain join this way. Auto-join runs when someone signs in or confirms their email. Existing members are left alone, and people keep their personal workspace and its links.

Plans and removal

Verified-domain auto-join is part of the Agency and Provider plans. After a downgrade the domains stay listed but nobody joins through them; you can still remove them.

Removing a domain stops new colleagues joining through it. Existing members stay, and pending join requests remain for you to decide. Seats work as described in Teams and roles.