[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing domains > Verifying a domain

# Verifying a domain


You can use only verified [domains](../../concepts/domains.md) to add users.

To validate a domain, you must be its owner and have the credentials to modify DNS records on the website of your domain’s DNS provider.

## Verifying a domain in a user pool {#userpool}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  1. In the left-hand panel, click ![userpool](../../../_assets/organization/userpool.svg) **User pools** and select the [user pool](../../concepts/user-pools.md).
  1. Select the domain you need to verify.
  1. In the section that opens, you will see the details you will need to pass the domain rights check.
  1. After completing the verification, click **Confirm**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.  

  1. Confirm that the domain belongs to you:

     1. Go to the DNS records management section on your domain's DNS provider's website:
     1. Add a TXT record with the following parameters:

        * **Host** or **Subdomain**: `_yandexcloud-challenge`.
        * **Text** or **Value**: The `value` field value you got after [associating the domain](add-domain.md).

     1. Wait for the DNS records to update. The update may take up to 72 hours.

  1. See the description of the CLI command for validating your domain in a [user pool](../../concepts/user-pools.md):

     ```bash
     yc organization-manager idp userpool domain validate --help
     ```

  1. Run this command:

      ```bash
      yc organization-manager idp userpool domain validate <pool_ID> <domain> \
        --name <domain>
      ```

      For example, validate `my-domain.ru` in `my-federation`:

      ```bash
      yc organization-manager federation saml validate-domain my-federation \
        --domain my-domain.ru
      ```

- API {#api}

  Use the [Userpool.ValidateDomain](../../idp/api-ref/Userpool/validateDomain.md) REST API method for the [Userpool](../../idp/api-ref/Userpool/index.md) resource or the [UserpoolService/ValidateDomain](../../idp/api-ref/grpc/Userpool/validateDomain.md) gRPC API call.

{% endlist %}

## Verifying a domain in an identity federation {#federation}

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Confirm that the domain belongs to you:

     1. Go to the DNS records management section on your domain's DNS provider's website.
     1. Add a TXT record with the following parameters:

        * **Host** or **Subdomain**: `_yandexcloud-challenge`.
        * **Text** or **Value**: The `value` field value you got after [associating the domain](add-domain.md).

     1. Wait for the DNS records to update. The update may take up to 72 hours.

  1. See the description of the CLI command for validating your domain in a [federation](../../concepts/add-federation.md):

     ```bash
     yc organization-manager federation saml validate-domain --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager federation saml validate-domain <federation_name_or_ID> \
       --domain <domain>
     ```

     Where `--domain` is your domain.

     For example, validate `my-domain.ru` in `my-federation`:

     ```bash
     yc organization-manager federation saml validate-domain my-federation \
       --domain my-domain.ru
     ```

- API {#api}

   Use the [Federation.ValidateDomain](../../saml/api-ref/Federation/validateDomain.md) REST API method for the [Federation](../../saml/api-ref/Federation/index.md) resource or the [FederationService/ValidateDomain](../../saml/api-ref/grpc/Federation/validateDomain.md) gRPC API call.

{% endlist %}