> For the complete documentation index, see [llms.txt](https://docs.overleaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.overleaf.com/groups/overleaf-group-single-sign-on/domain-management.md).
# Domain management
{% hint style="warning" %}
Domain management features, including domain verification and domain capture, are currently available to selected Pro group subscriptions through a **limited beta program**. If you are interested in learning more about this forthcoming feature, please [contact Overleaf Support](https://www.overleaf.com/contact).
{% endhint %}
Domain management features for Overleaf Pro groups help streamline onboarding of managed users using single sign on (SSO) and help ensure that all user accounts in your organization are managed.
These features allow subscription administrators to identify and verify domains that their users will be registering their Overleaf accounts under. Once domains are verified and confirmed, users registering under these domains will automatically be onboarded to the subscription.\
\
There are two key components to domain management in Overleaf: **domain verification** and **domain capture**.
* **Domain verification** allows Pro group subscribers to claim email domains of users that should be included in their subscription membership list. Verification of claimed domains is completed using a standard DNS TXT record method.
* Once domains are verified, Overleaf support will confirm the domains and activate **domain capture**. The domain capture feature automatically enrols users under verified domains into the organization's Overleaf subscription as managed users.
These features are sometimes referred to as **domain claiming**, and enable Just-In-Time (JIT) SSO provisioning, account consolidation, and mandatory SSO routing.
## Benefits of domain verification and capture
The domain verification capabilities of Overleaf Pro group subscriptions ensure that organizations can assert their ownership of domains using standard processes (DNS TXT records) that are used across many domain name registrars.
Domain capture greatly streamlines user onboarding, eliminating the need to directly invite team members to the subscription. By enabling domain capture, organizations can take steps to address problems of "Shadow IT." Accounts set up using email addresses under their domains are directed to join the group subscription, use SSO, and adhere to established configuration settings that govern integration and feature use.
## Domain verification: Plan for success
To complete domain verification, you must add a specific TXT record to your organization's DNS settings. It is not unusual for Overleaf Group Admins to not have direct access to their organization's DNS management portal. Please ensure you have a process in place to request a DNS update from your IT team before you begin the domain capture process. If you do not have access to your organization's DNS management portal, you will need to work with your IT team as described below.
{% hint style="info" %}
To activate domain capture for verified domains, your Overleaf subscription must have a valid and active [SSO configuration](/groups/overleaf-group-single-sign-on/setting-up-group-sso.md) and the [managed users](/groups/user-management/managed-user-accounts.md) feature must be enabled. Your SSO configuration must be updated to include the release and identification of a [user email attribute](#required-update-to-sso-configuration-user-email-address).
{% endhint %}
{% hint style="info" %}
Overleaf treats subdomains (e.g., `engr.example.com`) as distinct from root domains (`example.com`). Subdomains are not automatically captured by a root domain verification. Please be sure to include all active subdomains when verifying and capturing domains for your Overleaf Pro group.
{% endhint %}
## Setting up domain verification and capture
To set up domains for verification and domain capture, Pro group admins need to follow these steps:
1. Check the domains that are listed and add any additional domains to be verified to the domain management table (in the admin's group settings);
2. Generate and copy the Overleaf verification token for any domains that you wish to verify;
3. Add the TXT record through your domain registrar or DNS provider's management console;
4. The Overleaf subscription admin will receive an email notifying them when domains have been successfully verified. Admins can also check the status of the verification of the domain in the domain management table;
5. Notify Overleaf Support to request that domain capture be activated on your verified domains – admins can do this by replying to the domain verification confirmation email that is sent to them, or by directly contacting Overleaf Support;
6. Wait for the domain capture to be activated – the subscription admin will receive an email notifying them when domains have been confirmed and domain capture is active.
Once these steps have completed for a specific domain, domain capture is active. You will receive an email. You can monitor your members list or subscription audit log for any new users that have joined by registering or adding an email address with one of your verified and active domains.
{% hint style="warning" %}
Note: Before domain capture can be enabled, a user email attribute must be added to your SSO configuration. You must test your configuration to ensure that this email attribute is being released by your SSO identity provider.
{% endhint %}
{% stepper %}
{% step %}
### Check and update the domain management table
The domain management table is available to Overleaf Pro admins on subscriptions where domain capture has been made available.
{% hint style="warning" %}
If you are the administrator of a Pro group with SSO and Managed Users enabled and do not see domain management options in your group settings, please [contact Overleaf Support](https://www.overleaf.com/contact).
{% endhint %}
Domains can be added to the table using the "Add domain" button at the bottom of the table. If your organization uses subdomains for email routing, ensure you add each subdomain as a separate line item in this table. Once a domain is added, the domain is listed as "pending" verification and a token is generated and presented.
Domains that are added by admins will directly enter the **pending** state. You may see some existing domains in the table that were not added by the group administrator. These are domains that are already known to Overleaf that may be part of your organization. These pre-existing domains are not checked by Overleaf and will not be verified unless they are acknowledged by the group administrator.
If there are domains in the table that should not be associated with your subscription, please [contact Overleaf Support](https://www.overleaf.com/contact).
{% endstep %}
{% step %}
### Obtain the Overleaf verification token
To initiate the process of domain verification you need copy the verification token that will be used to create a TXT record with your DNS provider or domain registrar.
You can copy the token as needed by clicking on the dropdown menu next to the domain name, which will be in the pending state.
{% endstep %}
{% step %}
### Add the TXT record using your domain registrar or DNS provider's management console
If you have access to your domain registrar or DNS provider's management portal, please follow these basic steps, which can vary depending on the interface that is provided to you.
1. Navigate to your DNS management or Zone Editor page.
2. Create a New DNS Record using the exact values outlined below:
| **Field** | **Value** |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Record Type | TXT (Text) |
| Host | @ or blank for root, or the subdomain name |
| Value | The Overleaf verification token (the full string, including "overleaf-verification=". Ensure there are no leading or trailing spaces in the token you pasted, as this will cause verification to fail. |
| Time To Live (TTL) | Set the TTL (Time to Live) to a low value, such as 300 seconds (5 minutes), when creating this record. Once verified, you can change this setting to your system's default. |
Note that TTL is not an expiration time for the record itself; it dictates how long external servers cache the record before checking for updates. A lower TTL value (5 minutes) is recommended when first configuring a new DNS TXT record. This ensures that if there are any typos or misconfigurations, they can be corrected and updated across the internet quickly. Once verified, you can raise the TTL value.
If you need to submit a ticket to your IT department to have this completed, the request may be stated as:
> We are in the process of configuring domain capture for our Overleaf subscription. To verify our domain ownership, we need to add a DNS TXT record for our domain(s). Please create a DNS TXT record for domain **\[domain to be captured]** with value **\[Overleaf token value]**. Please set the TTL to be brief for now (300 seconds), in case we need to update the value here.
> {% endstep %}
{% step %}
### Check the status of the verification of the domain capture table
Once the DNS record has been added, it should be accessible for verification by Overleaf. Our system will automatically attempt to verify the DNS record, but it may take some time for the record to propagate and to be detected by Overleaf.
{% hint style="warning" %}
Please be aware that updates to domain registries can take up to 24 or 48 hours.
{% endhint %}
While the DNS record is propagating, your domain will be in the **pending** state. If you trigger a validation attempt directly by clicking on the refresh icon next to the status, the domain may show as having **failed** verification. This does not necessarily indicate a problem, as the DNS record may still not be visible on public networks. Please wait 24 hours for the verification to proceed automatically, or before refreshing again.
Please see the troubleshooting section below for instructions on checking your DNS record manually, and get in touch with Overleaf support if a manual check passes but Overleaf continues to report a failure.
{% endstep %}
{% step %}
### Notify Overleaf Support
Once a domain has been verified, it must still be confirmed by Overleaf Support before domain capture is activated for this domain. Overleaf Support checks that the domain is exclusively associated with your subscription, and ensures that the domain is correctly recognized in Overleaf before activating domain capture on the domain.
{% hint style="success" %}
The recommended way to request domain capture to be activated is to reply to the email that confirmed that your domain is verified.
{% endhint %}
You can notify Overleaf Support that a domain is ready to be confirmed and activated by replying to the email that is sent to the subscription administrator after successful verification. The subscription administrator can also [reach out directly to Overleaf Support](https://www.overleaf.com/contact) to request that a domain be confirmed and activated
{% endstep %}
{% step %}
### Wait for domain capture to be activated
Once domain confirmation and activation has been requested, domain capture will remain inactive until the Overleaf Support team confirms that the verified domains are exclusively associated with your subscription.
{% hint style="warning" %}
Please note that the confirmation and activation process can take up to two business days.
{% endhint %}
{% endstep %}
{% endstepper %}
## Required update to SSO configuration: user email address
Capturing new and existing user accounts under a domain requires that your SSO Identity Provider (IdP) sends a user email address for each user login.
In your existing IdP configuration for Overleaf, you must ensure that a user email address is being released to Overleaf. Note that this may already be configured, particularly if you are using the user email address as the unique identifier for your user logins.
{% content-ref url="/pages/NFUfuShOELROjMHf1K3y" %}
[Step 1: Add Overleaf to your Identity Provider](/groups/overleaf-group-single-sign-on/setting-up-group-sso/step-1-add-overleaf-to-your-identity-provider.md)
{% endcontent-ref %}
In your Overleaf SSO settings, provide the attribute name that user email addresses will be released under. Test to ensure that the attribute name that you have provided Overleaf is the same name that your IdP is releasing the email address under.
{% content-ref url="/pages/nRONfuj2U4AHHUg9iqFf" %}
[Step 2: Configure your SSO settings with IdP metadata](/groups/overleaf-group-single-sign-on/setting-up-group-sso/step-2-configure-your-sso-settings-with-idp-metadata.md)
{% endcontent-ref %}
## Domain management process overview
The diagram below illustrates the workflows involved in domain verification and capture as described in the [steps listed above](#setting-up-domain-verification-and-capture).
This diagram helps to illustrate the different responsibilities in domain verification and capture.
The **Pro group administrator** (Customer) will:
* Add or acknowledge domains in the domain management table;
* Verify that the SSO configuration includes a user email attribute;
* Set the Overleaf verification token as a TXT record for the domain to your DNS Provider;
* Request that Overleaf Support confirm and activate capture for verified domains.
The **Overleaf System** will:
* Check the DNS records of the domain for the Overleaf verification token;
* Notifiy the group administrator of changes in verification and capture state;
* Make domain capturing active on verified and confirmed domains.
The **Overleaf Support team** will:
* Confirm and activate domain capture for verified domains upon request.
## The domain management table
The domain management table is an important tool that allows Overleaf Pro admins to understand the verification and capture states of each of their domains. The table can be found on the subscription settings page of the group administrator's Overleaf account.\
\
This table shows the list of domains that have been added directly by the subscription administrator, or that were already associated with the group's organization in Overleaf.
| **Verification state** | **About this state** |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Generate token | Domains that Overleaf is already aware of for your organization will be listed without a token.
The administrator can acknowledge these domains by clicking on "Generate token" and place them in the pending state.
A domain that the admin removes will move out of the pending state and in to the "Generate token" state.
|
| Pending | When a domain is first added or acknowledged by the admin it is placed in the pending state. Overleaf will attempt to verify the token for the domain, this may take up to 24 hours.
Clicking the refresh button will trigger an immediate check for the token.
|
| Failed | If the token is not found, the domain will be listed in the failed state.
Clicking the refresh button will trigger an immediate check for the token.
Please be aware that if you have just updated your DNS settings, it may take up to 24 hours for the token to become accessible for the verification check.
|
| Verified | Domains that pass verification will move from the pending or failed state into the verified state.
Once verified, admins can send a request to Overleaf Support to confirm the domain and activate domain capture.
|
| Action Needed | Domains that have failed reverification are moved into an action needed state during a 14 day grace period while attempts are made at re-verification. |
| |
|---|
| Capture state | About this state |
| Inactive | When a domain has not yet been verified via DNS TXT record check and confirmed by Overleaf Support, domain capture for that domain is inactive.
The admin of the subscription can reply to the domain verification email or submit a request to Overleaf Support to request domain confirmation and domain capture activation. |
| Active | Once a domain has been verified and has been confirmed by the Overleaf Support team, domain capture will become active. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.overleaf.com/groups/overleaf-group-single-sign-on/domain-management.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.