> ## Documentation Index > Fetch the complete documentation index at: https://docs.athenahq.ai/llms.txt > Use this file to discover all available pages before exploring further. # Domain Access Settings > Lets organization admins configure email-domain-based auto-join rules that grant new users automatic access to the whole organization or to a specific subset of websites. `app.athenahq.ai/settings/domains` ## Purpose Organization admins can configure email-domain-based auto-join rules here. This lets new users who sign in with a verified matching email domain automatically join either the whole organization or a specific subset of websites, without needing individual invitations. ## What's on the page The page is grouped into two main sections: **Organization access** Shows rules that grant new users access to the entire organization. * **Domain row**: Shows the configured email domain (e.g., `@acme.com`). * **Status badge**: Shows a green `Verified` badge if the domain is approved, or a clickable yellow `Verify DNS` badge if it still needs DNS setup. * **Default role**: The role assigned to users who join via this domain (e.g., Viewer, Admin, or a custom role). * **Edit icon (pencil)**: Opens a dialog to change the default role or remove the domain. **Website access** Shows rules that grant new users access only to specific websites. * **Domain row**: The email domain. * **Status badge**: `Verified` or `Verify DNS`. * **Default role**: The role assigned to users on the granted websites. * **Edit icon (pencil)**: Opens a dialog to change which websites the domain grants access to, change the default role, or remove the domain grant. * **Website list**: Under each domain, lists the specific websites (with their logo and name) that users from this domain will automatically join. **Dialogs** * **Add Email Domain dialog**: Has an "Email Domain" input and a "Default Role" dropdown for org-wide access. * **Add website access domain dialog**: Has an "Email domain" input, a "Websites" multi-select dropdown, and a "Default role" dropdown. * **Verify domain ownership dialog**: Shows DNS TXT record details (`Type`, `Host / Name`, `Value`) and hints/links to the detected DNS provider. * **Edit domain dialog (Organization)**: Lets you change the "Default role" or click "Remove domain". * **Edit @domain dialog (Website)**: Lets you change the "Websites" multi-select, change the "Default role", or click "Remove domain". ## What you can do here * **Add an organization access domain**: Click **Add Domain** in the "Organization access" section. Fill in the domain and select a default role. If the domain isn't automatically verified, you will be prompted to verify it via DNS. * **Add a website access domain**: Click **Add Domain** in the "Website access" section. Enter the domain, select one or more websites, choose a default role, and save. * **Verify a domain via DNS**: Click the **Verify DNS** badge on an unverified domain. Click on the `Type`, `Host / Name`, or `Value` fields to copy them to your clipboard. Add them to your DNS provider, then click **Verify** in the dialog. * **Open DNS provider links**: Inside the verify dialog, you can click "Open dashboard" or "TXT record guide" to open your detected DNS provider in a new tab. * **Edit an organization domain**: Click the pencil icon next to an org-tier domain. Change the default role and click **Save**. * **Edit a website domain**: Click the pencil icon next to a website-tier domain group. Change the selected websites or default role and click **Save**. * **Remove an organization domain**: Click the pencil icon next to an org-tier domain, then click **Remove domain**. This stops new joins, but existing members keep their access. * **Remove a website domain**: Click the pencil icon next to a website-tier domain, then click **Remove domain**. This actively revokes the memberships this domain granted on the selected websites. * **Cancel**: Click **Cancel** on any dialog to close it without saving changes. ## Data shown * **Organization access domains**: The email domains configured to grant organization-wide access. * **Website access domains**: The email domains configured to grant access to specific websites, along with the list of those websites. * **Custom roles**: If your organization has custom roles configured, they appear in the default role dropdowns. ## Common workflows 1. **Add an organization-wide auto-join domain** * Click "Add Domain" in the Organization access section. * Enter the email domain (e.g. `example.com`). * Select a default role from the dropdown. * Click "Add Domain" to submit. * If the domain doesn't match an existing verified member's email, the Verify domain ownership dialog opens automatically. * Add the shown TXT record to the domain's DNS and click Verify. 2. **Grant a subset of websites to an email domain** * Click "Add Domain" in the Website access section. * Enter the email domain. * Select one or more websites from the multi-select (searchable) list. * Select a default role. * Click "Add Domain" to submit. * Verify via DNS if prompted. 3. **Edit an existing website-access domain's website list or role** * Click the pencil/edit icon next to a domain group under Website access. * Adjust the selected websites in the multi-select and/or change the Default role. * Click "Save" to apply, or click "Remove domain" to delete the grant entirely. 4. **Verify a pending domain via DNS** * Click the "Verify DNS" badge on an unverified domain (either section). * Copy the Type, Host / Name, and Value TXT record fields shown. * Add the TXT record in the domain's DNS provider (optionally follow the auto-detected provider's dashboard/docs links). * Return to the dialog and click "Verify". 5. **Remove an org-tier auto-join domain** * Click the pencil/edit icon on the domain row under Organization access. * Click "Remove domain" in the Edit dialog. * Confirm the domain disappears from the list (existing members keep their access; only future auto-joins stop). ## Empty, loading, and error states * **Empty**: If no domains are configured for a section, it shows "No domains configured." * **Loading**: A centered animated loader spinner is shown while the active organization is resolving. Skeletons show while the domain lists load. Action buttons show spinners while saving. * **Error**: Toast error messages appear for action failures (e.g. "Failed to add domain", "Failed to update domain", "Failed to remove domain", "Failed to verify domain", or "An error occurred while..."). ## Linked from / links to * **Linked from**: Settings navigation sidebar (Settings > Domain access). * **Links to**: The DNS verification dialog provides external links to your detected DNS provider's dashboard and TXT record guide. ## Common support questions * **Why was my domain automatically verified without a DNS record?** If an existing member in your organization already has a verified email address matching that domain, or if the organization already proved ownership of it elsewhere, Athena trusts the domain automatically. * **Why can't I set a default role higher than Viewer?** Only organization Admins can set a default role above Viewer. If you have a custom role that lets you manage settings but you aren't a full Admin, you can add domains but must leave the default role as Viewer. You will see a message saying "Only admins can set a default join role above Viewer." * **What happens when I remove a domain?** Removing an Organization access domain stops future users from automatically joining, but existing users keep their access. Removing a Website access domain completely revokes the access for users who joined those websites via the domain grant. * **Why is the Save button disabled when editing a website domain?** If you deselect all websites, you must explicitly click the red "Remove domain" button instead of saving an empty list.