Company domains

A company domain is the domain of the employees’ work email, for example company.ru. A verified domain gives you two things:

• Sign-in by work email. On the “Company SSO sign-in” screen the employee only has to enter ivan@company.ru — Buff works out which provider to send them to. Without a verified domain, they have to enter the organisation name.
• Automatic linking of existing accounts. If the employee already has a Buff account with an address on this domain (for example, they were invited earlier), the first SSO sign-in links the provider to that account without questions. For addresses on unverified domains Buff asks once for the existing account’s password — otherwise anyone whose provider claims “I am director@bigcorp.com” could take over someone else’s account.

A domain can be verified by only one organisation.

How to verify

1. In the “Single sign-on” section → “Company domains”, enter the domain and press “Add domain”.
2. Buff shows a TXT record: a name like _buff-sso.company.ru and a value like buff-sso-verify=<token>. Copy both.
3. Publish the record in your domain’s DNS (at the registrar or on your DNS server): type TXT, name _buff-sso, the whole value.
4. Press “Check”. Buff looks the record up; a DNS update can take from minutes to several hours — if the record has not propagated yet, try later.

You can remove the record after verification — the status is kept. Deleting the domain in Buff (the bin icon in its row) revokes both routing and auto-linking; account links already created remain.

What if an employee signs in by email before verification

They will see the message “Single sign-on is not set up for the domain …” with a hint to sign in by the organisation name. The existence of the organisation is not revealed: any other domain gets the same answer.