# Joining by email domain

Let people with verified company email addresses request or receive access.

## Verify a domain
An owner or admin opens **Company settings → Domains**, adds the company domain, and copies the TXT record into its DNS settings. You need a verified sign-in email at that domain; public email providers cannot be used as a company domain.

After publishing the record, choose **Check now** and wait for verification. Copy the exact record name and value from the app. Email-domain verification is separate from the preview feature that publishes Storybook on a custom domain.

## Choose how people join
| Mode | Effect |
| --- | --- |
| Disabled | Domain-based joining is not open. Invite members directly. |
| Anyone can request to join | Eligible people ask for access; admins approve each request and choose its role. |
| Anyone can join | Eligible people join directly with the configured automatic role. Only the owner can enable this mode. |

The joining policy is shared across the company's verified domains. The automatic role defaults to viewer and cannot be admin. Review it before enabling automatic access: an email domain can include contractors or people who should not see every project.

## Review requests
Owners and admins review join requests, choose a suitable role, and approve or reject them. Requests expire after the configured period. An expired request should be submitted again rather than assumed approved.

## Maintain access
Removing a domain prevents relying on it for future domain-based access; review existing memberships separately when someone leaves. Use the members page to remove access and company security settings to require two-factor authentication.