If you have a private domain (e.g., yourcompany.com), you can claim and verify it in Expensify to manage employee permissions and enable additional security features.

What you can do with a claimed and verified domain

Once you’ve claimed and verified a domain, you can:

• Configure SAML login
• Enforce SAML login for domain members

How to claim a domain in Expensify

To claim a private domain, you must:

• Be logged in with an email address from that domain
• Have verified your contact method with a magic code

1. From the left-hand menu, select Workspaces, then select the Domains tab.
2. Click New domain.
   • If you have already claimed one or more domains, click New in the upper right to add a new domain.
3. Enter the name of your private domain (e.g., yourcompany.com) in the form.
4. Click Continue.

Where to find Domain settings

From the left-hand menu, select Workspaces, then select the Domains tab.

If you haven’t claimed a domain yet, you’ll see an empty state titled Enhance your security with domains explaining the benefits of domain control. Once you claim a domain, it’s listed on the Domains tab.

Each domain is listed in its own row, showing:

• Domain name
• Verification status (Verified, Not verified)
• The three dots (⋮) with management options

What happens after claiming a domain?

Depending on your email setup:

• If you’re not using an email from that domain: You’ll see an error. You can’t claim domains that don’t match your email address.
• If your email is from that domain but not verified: You’ll be prompted to verify your login using a magic code.
• If the domain is already claimed: You’ll need to coordinate with an existing admin to request that your role be updated to Domain Admin.

After the domain is successfully claimed, the domain will appear on the Domains tab in the Not verified state.

How to verify a domain

To unlock advanced security settings and enable SAML, the domain must be verified through a DNS record.

Steps to verify your domain

Note: This process may be managed by your IT department or web consultant.

1. Log in to your DNS service provider (e.g., Namecheap, GoDaddy, Amazon Route 53).
2. Locate the DNS Records page (sometimes labeled as DNS Management or Zone File Editor).
3. Add a TXT record with the verification value provided in Expensify. To find it, go to the Domains tab, select the three dots (⋮) next to your domain, then select Verify domain.
4. Save your changes.

Once verified, you’ll see a confirmation message and your domain will be marked as Verified.

FAQ

Do I need to verify my domain to use SAML?

Yes. Verifying the domain is required to enable and enforce SAML login. Without verification, the SAML configuration option will remain locked.

Can I verify multiple domains?

Yes, you can claim and verify multiple domains if your organization operates under more than one. Each must be verified through its own DNS record.

Can I skip domain verification and still use Expensify?

Yes, you can use Expensify without claiming a domain. However, domain control is required to enable SAML login and enforce centralized security policies.

I added the TXT record but verification is still failing — what now?

Make sure:

• The record is live and publicly visible (use a DNS checker tool to confirm)
• You’ve added only one TXT record, and it matches the value from Expensify exactly
• You saved the changes and waited for DNS to propagate

If you’re still stuck, reach out to your IT team or DNS host for help.