# Email domains

SSO trusts your identity provider only for addresses on domains the workspace has proved. That's the whole trust model, so it's checked on every sign-in.

### 1. Add the domain

On the workspace's SSO settings page, add your company's domain, such as `acme.com`. The page gives a token starting with `l10-sso-`.

### 2. Publish the TXT record

Add a TXT record at `_latitude10-sso.<domain>` whose value is the token, for example at `_latitude10-sso.acme.com`.

### 3. Check it

Choose **Check now** beside the domain. Once the record is found, the domain is proved.

## The rules

- A proved domain belongs to one workspace at a time.
- Public email services, such as Gmail, Outlook, Yahoo, iCloud and Proton, can't be proved: owning an address there says nothing about a company.
- A proof is checked again on a sign-in once it's 30 days old. If the record is gone, the domain stops being proved. If DNS can't answer, nothing changes.
- How many domains a workspace may prove depends on the plan: see [Plans and limits](../get-started/plans-and-limits#enterprise).

## Where this comes from

- `app/enterprise/_lib/domains.ts`
- `app/enterprise/_lib/sso.ts`
- `app/hosted-mcp/_lib/upstream.ts`