Your values Fill in your own to see them in every example
The domain in your people’s email addresses, as proved in the hub.
That doesn’t look right yet. For example: example.com
The part after token= in the record the hub shows under Directory → Domains.
That doesn’t look right yet. For example: 3f9a1c2b4d5e6f708192a3b4c5d6e7f8
Saved in this browser only, for every page of these docs. Nothing you type leaves this page.
A domain you’ve proved is how Trustaige recognizes people at that address as your organization’s, and how another organization knows who it’s dealing with. Ownership is decided by DNS: you publish a TXT record that only someone who controls the domain could publish. Nothing else counts, because nothing else survives the person who set it up leaving.
Your organization starts with one domain, the primary domain, taken from the email address it was created with. That domain is proved by email at first: it shows the mailbox worked, not that you control the domain. Prove it by DNS too, and add any other domains your people’s addresses use.
The primary domain is the one your organization is known by: the default for invitations and imports, and the address Windows PCs use to find enrollment (see Windows devices).
Before you begin
| You need | Why |
|---|---|
| The Manage settings permission, or superadmin | The Domains page needs it. Adding or removing a domain and changing the primary also ask you to confirm it’s you. |
| Someone who can add a TXT record to the domain’s DNS | That record is the proof. You can hand the record to them straight from the hub. |
Domains are in the hub under Directory → Domains.
Add a domain
- Open Directory → Domains and click Add domain.
- Type the domain, for example
example.com, and click Add. You can paste a whole email address; the hub keeps the part after the@. - The domain appears as Pending. Open it to see the record to publish.
Personal and disposable email domains can’t be added.
Proof covers the exact domain and nothing beneath it. A subdomain such as
eng.example.com is a separate domain and needs its own record, so proving one
name never grants authority over a whole tree.
Publish the record
Open the domain on the Domains page. It shows the record as Record type, Name and Value, each ready to copy:
Type: TXT
Name: _trustaige-verification.<your-domain>
Value: token=<your-domain-verification-token> expiry=never| Field | What to enter |
|---|---|
| Name | _trustaige-verification followed by your domain. Many DNS providers want only the part before your domain, _trustaige-verification, and add the rest themselves. |
| Value | The value exactly as the hub shows it: your domain’s own token, then expiry=never. Each domain has its own token. |
If someone else runs your DNS, click Send to whoever runs your DNS. It copies a ready-to-send request with the record in it, saying that the record only proves control to Trustaige and doesn’t affect mail, websites or anything else in the zone.
The record doesn’t affect anything else on the domain. Leave it in place after the domain is proved.
Type: TXT
Name: _trustaige-verification.<your-domain>
Value: token=<your-domain-verification-token> expiry=neverCheck the record
Once the record is published, open the domain and click Check the record. Trustaige asks several independent DNS resolvers. It accepts the record when your zone is signed with DNSSEC and validates, or otherwise when independent resolvers agree on it. A new record can take a few minutes, and sometimes up to an hour, to reach all of them.
When the check passes, the domain shows Proved and Proved by DNS record. If it doesn’t, the hub says why, and when resolvers disagree or can’t be reached it lists what each one saw.
For the primary domain, which starts out proved by email, the button is Prove by DNS. It works the same way.
Change the primary domain
Any domain proved by DNS can become the primary. Open it, click Make primary, and confirm. Your current primary stays proved and keeps working until you remove it; Private Access apps you’ve already published keep their addresses.
Only a domain proved by DNS can be made primary.
Remove a domain
Open the domain and click Remove, then Remove domain. People at that address are no longer recognized as your organization’s. You can add the domain again later, but only by proving it again with a new record.
The primary domain can’t be removed. To move away from it, prove another domain and make that one primary first.
Troubleshooting
Record not found: “No TXT record was found at _trustaige-verification…”
The record isn’t published yet, or not under that name. Check the name in your
DNS provider: if it added your domain itself, the record may have ended up at
_trustaige-verification.<your-domain>.<your-domain>. Records can take up to an
hour to propagate.
Record mismatch: “A TXT record exists… but none carries the value below.”
There’s a TXT record at that name, but not with this domain’s value. Copy the Value from the hub again; each domain has its own, and removing and adding a domain again gives it a new one.
Still propagating: “DNS resolvers don't agree… yet.”
Some resolvers still hold the answer from before you published the record. That clears within an hour; check again then.
Lookup failed: “Not enough DNS resolvers could be reached…”
Trustaige couldn’t get enough answers to trust. This says nothing about your record. Try again in a few minutes.
Not available: “… is already verified by another organization.”
Another Trustaige organization has proved this domain. If it belongs to you, contact Trustaige; the hub doesn’t settle disputes between organizations.
“personal and disposable email domains cannot be added”
The domain is a consumer email provider or a disposable address service. Only a domain your organization controls can be proved.
“domain already added”
The domain is already on your Domains page. Open it there.
“Prove this domain with a DNS record first.”
Only a domain proved by DNS can become the primary. Publish its record and click Check the record first.