---
title: "Prove a domain before trusting it · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/organisations-and-teams/verified-domains
updated: 2026-10-20
licence: "All rights reserved"
---

# Prove a domain before trusting it

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Organisations and teams](https://agentwranglers.se/playbook/accounts/organisations-and-teams)
- Rule: Let an organisation claim an email domain only after it publishes a DNS TXT record you gave it. Only then may the domain route sign-in or let people join.
- How: Make a random value per organisation and domain, such as `example-verification=8f3a91c2`. Look up the TXT record and compare. Check again daily, and drop the claim after 7 days of failures. Never allow a claim on a public mail domain, such as gmail.com or outlook.com. A verified domain may offer joining to new sign-ups, route sign-in to the organisation's [single sign-on](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/organisation-sso), and require it.
- Check: Claim a test domain without the record, and verification fails. Add the record, and it passes. A claim on `gmail.com` is refused.

Example:

```js
import { resolveTxt } from 'node:dns/promises';

export async function isDomainVerified(domain, expected) {
  const records = await resolveTxt(domain).catch(() => []);
  return records.some(parts => parts.join('') === expected);
}
```

```python
import dns.resolver

def is_domain_verified(domain: str, expected: str) -> bool:
    try:
        answers = dns.resolver.resolve(domain, "TXT")
    except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
        return False
    return any(b"".join(record.strings).decode() == expected for record in answers)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/organisations-and-teams/verified-domains`.

- Previous: [Make invitations expire and work once](https://agentwranglers.se/playbook/accounts/organisations-and-teams/invitations)
- Next: [Never leave an organisation without an owner](https://agentwranglers.se/playbook/accounts/organisations-and-teams/last-owner)
- [Organisations and teams](https://agentwranglers.se/playbook/accounts/organisations-and-teams)