Adopt a domain

If your organization owns a domain (example.com, your company’s domain, a personal domain you control), an owner of that organization can adopt it on Sudomimus. Once adopted, the domain belongs to your organization on the platform: it is bound exclusively to the organization that proved control of it.

Adoption is the foundation the rest of this section builds on — it is the ownership primitive that a login policy and enterprise federation attach to. On its own, an adopted domain has no effect on any sign-in flow; it becomes load-bearing the moment you give it a policy.

What an adopted domain gives you

• Exclusive ownership. A verified domain is bound to a single organization. No other organization can hold a verified claim on the same domain while you hold it.
• A mount point for policy. Once verified, the domain can carry a login policy (allow / block / force SSO) and can be bound to one of your federation connectors.

Why this exists

Most authentication products treat domain ownership as a paid enterprise feature. In Sudomimus it is a first-class primitive — the platform already needs to verify which email addresses belong to whom in order to support email OTP, and domain adoption is a natural extension of that model.

It is particularly useful when:

• You run a company whose employees share a domain.
• You operate a community or organization whose members share a domain.
• You want a verified, organization-owned claim on your domain as the basis for policy and federation.

The adoption flow

1. Initiate adoption from the With portal at with.sudomimus.com: pick one of your organizations and claim the domain you want against it. Only an organization owner can start an adoption.

2. Publish the DNS record. Sudomimus gives you a one-line TXT record to add to the domain:

   Field	Value
   Host / name	_sudomimus-challenge.example.com
   Type	TXT
   Value	sudomimus-domain-verification=<your-token>

   The dedicated _sudomimus-challenge subhost keeps the record clear of any apex SPF / DKIM / other TXT records you already publish. The token is fixed for the life of the claim.

3. Verify. Back in the portal, click Verify. Sudomimus performs one live DNS lookup, compares the record, and on success binds the domain exclusively to your organization. The claim moves from PENDING to VERIFIED.

DNS takes a moment to propagate

Verification is on-demand and synchronous — there is no background polling. If you click Verify before the record has propagated (or while a stale “no such record” answer is still cached by the resolver), it can fail for a short while. Wait a minute and retry.

Contested domains and exclusivity

• Pending claims may coexist. Two organizations can each have a PENDING claim on the same domain — initiation is not exclusive.
• Verification is the exclusive gate. Only one organization can hold a VERIFIED claim at a time: whoever proves DNS control first wins the single verified slot. (This is deliberate — it stops anyone from “squatting” a competitor’s domain in pending state.)
• Verifying a domain another organization already holds fails with DomainAlreadyAdopted.

Releasing a domain

Releasing a domain is permanent for that claim. The same organization or another organization may adopt the domain again later, but that creates a new claim and requires DNS verification again.

An owner may release a pending claim. Releasing a verified domain requires the organization’s sole owner. The release frees one active-domain quota slot.

Caution

Before releasing a verified domain, set its login policy to ALLOW_ALL. Sudomimus will not silently remove a blocking or SSO policy during release.

Quota

Each organization can hold a limited number of active domain claims (default 3, counting pending and verified together). Releasing a claim frees an active slot, and Sudomimus staff can raise this active limit on request.

There is also a lifetime limit of 32 domain claims per organization. Released claims still count toward this limit, so do not repeatedly release and re-adopt a domain as a routine configuration change.

Domain format

Sudomimus accepts standard ASCII domains with at least two labels (example.com, mail.example.co.uk). Internationalized (punycode / xn--) domains are not accepted yet. Apex and subdomains are independent claims — adopting example.com does not adopt mail.example.com.

Related

Domain login policyNow that the domain is verified, decide how its users may authenticate.

Federation connectorsRegister the OIDC or SAML identity provider you will bind this domain to.