Verify email domain for single sign-on
(Updated: )To enable single sign-on for your Leebry organization, an admin must first verify ownership of the email domain used by your users, such as macpaw.com. Once the domain is verified, Leebry can associate users from your identity provider with accounts in your Leebry organization.
Add a domain for verification
Only organization admins can manage verified domains.
To add a domain for verification in Leebry:
Sign in to Leebry as an organization admin.
In the bottom-left corner, click your user name, then choose SSO Settings.
In the SSO Settings dialog, go to the Verified Domains tab.
Click "Add domain".
The "Add Verified domain" dialog opens.
In the "Domain name" field, enter the domain you want to verify, such as
macpaw.com.Enter only the domain used in your users' email addresses. For example, if a typical email address is
[email protected], entermacpaw.com— not a full URL such ashttps://macpaw.comor a subdomain such aslogin.macpaw.com.Click Continue.
The "Select verification method" dialog opens.
Choose a verification method, then click Continue.
| Method | Details |
|---|---|
| DNS TXT record | Add a TXT record to your domain's DNS configuration so Leebry can verify domain ownership. |
| HTML meta tag | Add an HTML meta tag to your domain's homepage so Leebry can verify domain ownership. |
| Verification file | Upload a verification file to your website so Leebry can verify domain ownership. |
The following sections explain how to complete each verification method using the verification token provided by Leebry.
Verify using a DNS TXT record
This is the recommended verification method.
Use this method if you can manage DNS records for your domain through your DNS provider.
Open the DNS settings for your domain with your DNS provider, such as Cloudflare, Amazon Route 53, GoDaddy, or your domain registrar.
Create a TXT record for the root domain:
Name/Host: Enter @ or leave the field blank, depending on your provider's conventions.
Type: Select TXT.
Set the TXT record value to
leebry-domain-verification={verificationToken}Replace
{verificationToken}with the verification token shown in Leebry for this domain. Don't include braces, additional spaces, or line breaks.Save the TXT record and wait for the DNS record to propagate.
This can take several minutes or several hours, depending on your provider and TTL settings.
You can use a DNS checking tool such as DNS Checker to confirm that the TXT record is publicly visible.
In Leebry, go to SSO Settings > Verified Domains.
In the Status column for the domain, which should show Pending, click Verify.
If Leebry finds the TXT record with the expected value, the domain status changes from Pending to Verified. You can then continue configuring SSO for your organization.
Verify using an HTML meta tag
Use this method if you can edit the HTML of your website's homepage for the domain you're verifying.
Open the HTML file for your website's homepage at
https://{domain}/.For example, if you're verifying
macpaw.com, open the HTML file forhttps://macpaw.com/.In the
<head>section, add the following meta tag:<meta name="leebry-domain-verification" content="{verificationToken}">Replace
{verificationToken}with the exact verification token shown in Leebry for this domain.Deploy or publish changes so the homepage with the meta tag is publicly accessible over HTTPS.
Confirm that the tag is present:
Open the homepage in a web browser.
View the page source and check the
<head>section for theleebry-domain-verificationmeta tag.
In Leebry, go to SSO Settings > Verified Domains.
In the Status column for the domain, which should show Pending, click Verify.
If Leebry can retrieve the homepage and find the meta tag with the expected verification token, the domain status changes from Pending to Verified. You can then continue configuring SSO for your organization.
Verify using a verification file
Use this method if you can host a static file at a specific URL on your domain. Leebry generates the verification file, so you don't need to create or edit it manually.
Download the verification file provided by Leebry, named
leebry-domain-verification.txt.Upload the file to your web server or hosting platform so it's publicly available at:
https://{domain}/.well-known/leebry-domain-verification.txtFor example, for
macpaw.com, the file should be available at:https://macpaw.com/.well-known/leebry-domain-verification.txtConfirm that the URL works:
Open the URL in a web browser.
Make sure the server returns a 200 status code and the file contents match the file provided by Leebry exactly.
In Leebry, go to SSO Settings > Verified Domains.
In the Status column for the domain, which should show Pending, click Verify.
If Leebry can retrieve the file from the .well-known path and its contents match the expected verification data, the domain status changes from Pending to Verified. You can then continue configuring SSO for your organization.
Check verification status
After you click Verify, Leebry checks the chosen verification method.
Verified — The domain ownership has been confirmed. You can continue configuring SSO for your organization with your identity provider.
Pending — Verification hasn't been completed yet. Make sure your DNS record, meta tag, or verification file is publicly accessible, then click Verify again.
Failed — Leebry couldn't verify ownership of the domain. This can happen if DNS records or website changes haven't propagated yet. Update the DNS record, HTML meta tag, or verification file as needed, then click Verify again.
Cancel verification
If you no longer want to verify a domain or want to start over:
In Leebry, go to SSO Settings > Verified Domains.
Click More (⋮) next to the domain you want to remove, then choose Delete.
Troubleshoot verification
If verification continues to fail:
Make sure you've entered the correct domain rather than a subdomain or full URL.
Make sure the verification token in the DNS TXT record, HTML meta tag, or the
.well-knownfile exactly matches the token shown in Leebry. The token is case-sensitive and mustn't contain quotation marks, extra spaces, or line breaks.Use a DNS checking tool or your browser's developer tools to confirm that the DNS record, meta tag, or verification file is publicly accessible.
