# Prove your organization's domains > Prove you control your email domains with a DNS TXT record, so Trustaige recognizes people at those addresses as your organization's. Source: https://docs.trustaige.com/manage/domains Replace these placeholders with your organization's own values: - ``: Your domain, for example `example.com`. The domain in your people’s email addresses, as proved in the hub. - ``: Domain verification token, for example `3f9a1c2b4d5e6f708192a3b4c5d6e7f8`. The part after token= in the record the hub shows under Directory → Domains. A domain you've proved is how Trustaige recognizes people at that address as your organization's, and how another organization knows who it's dealing with. Ownership is decided by DNS: you publish a TXT record that only someone who controls the domain could publish. Nothing else counts, because nothing else survives the person who set it up leaving. Your organization starts with one domain, the **primary domain**, taken from the email address it was created with. That domain is proved by email at first: it shows the mailbox worked, not that you control the domain. Prove it by DNS too, and add any other domains your people's addresses use. The primary domain is the one your organization is known by: the default for invitations and imports, and the address Windows PCs use to find enrollment (see [Windows devices](/manage/windows-devices)). ## Before you begin | You need | Why | |---|---| | The **Manage settings** permission, or superadmin | The **Domains** page needs it. Adding or removing a domain and changing the primary also ask you to confirm it's you. | | Someone who can add a **TXT record** to the domain's DNS | That record is the proof. You can hand the record to them straight from the hub. | Domains are in the hub under **Directory → Domains**. ## Add a domain 1. Open **Directory → Domains** and click **Add domain**. 2. Type the domain, for example `example.com`, and click **Add**. You can paste a whole email address; the hub keeps the part after the `@`. 3. The domain appears as **Pending**. Open it to see the record to publish. Personal and disposable email domains can't be added. Proof covers the exact domain and nothing beneath it. A subdomain such as `eng.example.com` is a separate domain and needs its own record, so proving one name never grants authority over a whole tree. ## Publish the record Open the domain on the **Domains** page. It shows the record as **Record type**, **Name** and **Value**, each ready to copy: ```txt title="DNS record" Type: TXT Name: _trustaige-verification. Value: token= expiry=never ``` | Field | What to enter | |---|---| | **Name** | `_trustaige-verification` followed by your domain. Many DNS providers want only the part before your domain, `_trustaige-verification`, and add the rest themselves. | | **Value** | The value exactly as the hub shows it: your domain's own token, then `expiry=never`. Each domain has its own token. | If someone else runs your DNS, click **Send to whoever runs your DNS**. It copies a ready-to-send request with the record in it, saying that the record only proves control to Trustaige and doesn't affect mail, websites or anything else in the zone. The record doesn't affect anything else on the domain. Leave it in place after the domain is proved. ## Check the record Once the record is published, open the domain and click **Check the record**. Trustaige asks several independent DNS resolvers. It accepts the record when your zone is signed with DNSSEC and validates, or otherwise when independent resolvers agree on it. A new record can take a few minutes, and sometimes up to an hour, to reach all of them. When the check passes, the domain shows **Proved** and **Proved by DNS record**. If it doesn't, the hub says why, and when resolvers disagree or can't be reached it lists what each one saw. For the primary domain, which starts out proved by email, the button is **Prove by DNS**. It works the same way. ## Change the primary domain Any domain proved by DNS can become the primary. Open it, click **Make primary**, and confirm. Your current primary stays proved and keeps working until you remove it; Private Access apps you've already published keep their addresses. Only a domain proved by DNS can be made primary. ## Remove a domain Open the domain and click **Remove**, then **Remove domain**. People at that address are no longer recognized as your organization's. You can add the domain again later, but only by proving it again with a new record. The primary domain can't be removed. To move away from it, prove another domain and make that one primary first. ## Troubleshooting **Record not found: “No TXT record was found at _trustaige-verification…”** The record isn't published yet, or not under that name. Check the name in your DNS provider: if it added your domain itself, the record may have ended up at `_trustaige-verification..`. Records can take up to an hour to propagate. **Record mismatch: “A TXT record exists… but none carries the value below.”** There's a TXT record at that name, but not with this domain's value. Copy the **Value** from the hub again; each domain has its own, and removing and adding a domain again gives it a new one. **Still propagating: “DNS resolvers don't agree… yet.”** Some resolvers still hold the answer from before you published the record. That clears within an hour; check again then. **Lookup failed: “Not enough DNS resolvers could be reached…”** Trustaige couldn't get enough answers to trust. This says nothing about your record. Try again in a few minutes. **Not available: “… is already verified by another organization.”** Another Trustaige organization has proved this domain. If it belongs to you, contact Trustaige; the hub doesn't settle disputes between organizations. **“personal and disposable email domains cannot be added”** The domain is a consumer email provider or a disposable address service. Only a domain your organization controls can be proved. **“domain already added”** The domain is already on your **Domains** page. Open it there. **“Prove this domain with a DNS record first.”** Only a domain proved by DNS can become the primary. Publish its record and click **Check the record** first.