# Company domains

> A verified email domain routes an employee to your provider by work email and lets existing accounts be linked. Verification is a DNS TXT record.

A company domain is the domain of the employees’ work email, for example `company.ru`. A verified domain gives you two things:

- **Sign-in by work email.** On the “Company SSO sign-in” screen the employee only has to enter `ivan@company.ru` — Buff works out which provider to send them to. Without a verified domain, they have to enter the organisation name.
- **Automatic linking of existing accounts.** If the employee already has a Buff account with an address on this domain (for example, they were invited earlier), the first SSO sign-in links the provider to that account without questions. For addresses on **unverified** domains Buff asks once for the existing account’s password — otherwise anyone whose provider claims “I am director@bigcorp.com” could take over someone else’s account.

A domain can be verified by only **one** organisation.

## How to verify

1. In the **“Single sign-on”** section → “Company domains”, enter the domain and press **“Add domain”**.
2. Buff shows a TXT record: a name like `_buff-sso.company.ru` and a value like `buff-sso-verify=<token>`. Copy both.
3. Publish the record in your domain’s DNS (at the registrar or on your DNS server): type **TXT**, name `_buff-sso`, the whole value.
4. Press **“Check”**. Buff looks the record up; a DNS update can take from minutes to several hours — if the record has not propagated yet, try later.

_Illustration: The domain is added and the TXT record for DNS is shown; after the check the status changes to “verified”._

You can remove the record after verification — the status is kept. Deleting the domain in Buff (the bin icon in its row) revokes both routing and auto-linking; account links already created remain.

## What if an employee signs in by email before verification

They will see the message “Single sign-on is not set up for the domain …” with a hint to sign in by the organisation name. The existence of the organisation is not revealed: any other domain gets the same answer.