feat(sso): allow self-hosted DNS verification bypass (#8681)

* feat(sso): allow self-hosted DNS verification bypass

* fix(helm): document image requirement for DNS bypass

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -419,6 +419,8 @@ SSO_TRUSTED_PROVIDER_IDS=custom-oidc,partner-saml
 
 You can register providers through the **Settings UI** (same as cloud) or by running the registration script directly against your database.
 
+Restricted networks can opt out of the DNS challenge with the server-only `SSO_SKIP_DOMAIN_VERIFICATION=true` setting. Add the domain and click **Verify** before saving SSO. This trusts administrator claims across the instance and is ignored on Sim Cloud. See [skipping DNS verification](/platform/enterprise/verified-domains#skip-dns-verification) for the trust implications and [DNS network requirements](/platform/enterprise/verified-domains#restricted-networks) for the default setup.
+
 ### Script-based registration
 
 Use this when you need to register an SSO provider without going through the UI — for example, during initial deployment or CI/CD automation.

apps/docs/content/docs/platform/enterprise/verified-domains.mdx

@@ -67,7 +67,7 @@ Add each domain you own separately. Subdomains (`eng.acme.com`) are verified ind
 
 ## Self-hosted setup
 
-Domain verification has no flag of its own. It lives on the single sign-on page, so it appears exactly when SSO does:
+Domain verification appears on the single sign-on page when SSO is enabled:
 
 ```bash
 SSO_ENABLED=true
@@ -77,3 +77,35 @@ NEXT_PUBLIC_SSO_ENABLED=true
 `ENTERPRISE_ENABLED` turns both on together, but it needs its own browser twin — set `NEXT_PUBLIC_ENTERPRISE_ENABLED` alongside it, or the server and the settings page enable SSO while the login page still hides its SSO entry point. See the [self-hosted enterprise guide](/platform/enterprise/self-hosted).
 
 Once enabled, verify domains from **Settings → Organization → Single sign-on → Domains**. The older `/workspace/<workspaceId>/settings/domains` path still resolves to the same page.
+
+### Restricted networks
+
+Sim queries `1.1.1.1` and `8.8.8.8` directly from the application server. Allow outbound DNS on UDP and TCP port 53 to these addresses. The lookup uses public DNS rather than the server's local resolver or an HTTP proxy, so the TXT record must be published in a publicly delegated DNS zone. A Route 53 private hosted zone is not visible to these resolvers.
+
+### Skip DNS verification
+
+For a deployment where the operator trusts every organization owner and admin to claim email domains, set this server-only variable and restart the application:
+
+```bash
+SSO_SKIP_DOMAIN_VERIFICATION=true
+```
+
+For Helm deployments, use an application image built from a revision that includes this setting. Upgrading the chart alone does not make an older application image support the variable. Override `app.image.tag` with a compatible released image or a build you publish yourself; set `app.image.repository` as well for a custom repository:
+
+```yaml
+app:
+  image:
+    tag: "<image-tag-with-domain-verification-bypass>"
+  env:
+    SSO_SKIP_DOMAIN_VERIFICATION: "true"
+```
+
+If `app.image.digest` is set, replace it with a compatible image digest instead — it takes precedence over the tag.
+
+Add the domain under **Domains**, then click **Verify**. No TXT record or DNS access is needed. The domain is recorded as verified for SSO account linking and SCIM provisioning, and another organization still cannot claim the same domain. Existing pending domains can be verified the same way.
+
+<Callout type="warn">
+  This option is off by default and ignored on Sim Cloud. It applies to every organization in the self-hosted instance: an organization administrator can authorize their identity provider for any unclaimed email domain without proving ownership. Enable it only when those administrators are trusted to make that decision.
+</Callout>
+
+Removing the variable or setting it to `false` restores DNS verification for pending and future claims. Domains already verified remain verified; remove a domain in **Domains** to revoke its trust.

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -248,6 +248,7 @@ Enterprise features are unlocked by configuration rather than billing on self-ho
 |----------|-------------|
 | `ENTERPRISE_ENABLED`, `NEXT_PUBLIC_ENTERPRISE_ENABLED` | Enable the whole enterprise feature set |
 | `SSO_ENABLED`, `NEXT_PUBLIC_SSO_ENABLED` | Enable SAML and OIDC single sign-on on its own. See [Authentication](/platform/self-hosting/authentication#sso-saml-and-oidc) |
+| `SSO_SKIP_DOMAIN_VERIFICATION` | Skip the DNS challenge when an administrator clicks Verify on a domain. Off by default; self-hosted only. Trusts administrator claims for SSO and SCIM across the instance. See [Verified Domains](/platform/enterprise/verified-domains#skip-dns-verification) |
 | `SCIM_ENABLED`, `NEXT_PUBLIC_SCIM_ENABLED` | Enable directory provisioning on its own. Needs SSO. See [Directory provisioning](/platform/enterprise/scim) |
 | `INSTANCE_ORG_NAME` | Name of the organization every user joins automatically at signup |
 | `INSTANCE_ORG_SLUG` | Slug for that organization (derived from the name when omitted) |

apps/sim/.env.example

@@ -218,6 +218,11 @@ CRON_SECRET=your_cron_secret # Use `openssl rand -hex 32` to generate. Authentic
 # KNOWLEDGE_MEMBER_ACCESS=                                        # Per-member knowledge connectors and hybrid-by-default retrieval
 # ORGANIZATIONS_ENABLED= / NEXT_PUBLIC_ORGANIZATIONS_ENABLED=     # Organizations only
 
+# SSO domain verification (Optional - self-hosted, off by default). Trust every organization
+# owner and admin to claim email domains without DNS proof. Add a domain and click Verify.
+# Docs: https://docs.sim.ai/platform/enterprise/verified-domains#skip-dns-verification
+# SSO_SKIP_DOMAIN_VERIFICATION=true
+
 # Instance organization (Optional). Most enterprise features read their settings from the
 # organization that owns a workspace, so a deployment needs an organization for them to
 # apply. Setting a name puts every user in one shared org at signup and makes their

apps/sim/lib/core/config/env.ts

@@ -671,6 +671,8 @@ export const env = createEnv({
 
     // SSO Configuration (for script-based registration)
     SSO_ENABLED:                           z.boolean().optional(),                 // Enable SSO functionality
+    /** Trust administrator domain claims without DNS proof on self-hosted deployments only. */
+    SSO_SKIP_DOMAIN_VERIFICATION:          z.boolean().optional(),
     SCIM_ENABLED:                          z.boolean().optional(),                 // Enable SCIM directory provisioning
     USAGE_MONITORING_ENABLED:              z.boolean().optional(),                 // Enable organization usage monitoring on self-hosted (bypasses hosted requirements)
     SSO_PROVIDER_TYPE:                     z.enum(['oidc', 'saml']).optional(),    // [REQUIRED] SSO provider type

apps/sim/lib/organizations/application/domain-settings.ts

@@ -14,7 +14,8 @@ import {
 } from '@/lib/auth/sso/domain-verification'
 import { invalidateSsoPolicyCache } from '@/lib/auth/sso-policy'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
-import { isBillingEnabled } from '@/lib/core/config/env-flags'
+import { env, isTruthy } from '@/lib/core/config/env'
+import { isBillingEnabled, isHosted } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { defineOrganizationConfigurationUseCase } from '@/lib/organizations/application/authorized-configuration-use-case'
 import { organizationSecurityOperations } from '@/lib/organizations/application/security-operations'
@@ -60,6 +61,9 @@ function domainConflict(): never {
     'This domain is already verified by another organization'
   )
 }
+function requiresDomainDnsVerification(): boolean {
+  return isHosted || !isTruthy(env.SSO_SKIP_DOMAIN_VERIFICATION)
+}
 function providersOnDomain(organizationId: string, domain: string) {
   return and(
     eq(ssoProvider.organizationId, organizationId),
@@ -231,17 +235,19 @@ export const verifyOrganizationDomain = defineOrganizationConfigurationUseCase({
     if (!row) throw new OrchestrationError('not_found', 'Domain not found')
     if (row.status === 'verified')
       return { domain: domainValue(row, principal, true), verified: false }
-    const lookup = await checkDomainTxtRecord(row.domain, row.verificationToken)
-    if (lookup === 'unavailable')
-      throw new DomainVerificationLookupError(
-        503,
-        "We couldn't complete the DNS lookup, so we can't tell yet whether your record is published. Try again in a few minutes — if it keeps failing, check that your domain's nameservers are responding."
-      )
-    if (lookup === 'absent')
-      throw new DomainVerificationLookupError(
-        422,
-        'The verification TXT record was not found yet. DNS changes can take up to 48 hours to propagate — add the record shown and try again.'
-      )
+    if (requiresDomainDnsVerification()) {
+      const lookup = await checkDomainTxtRecord(row.domain, row.verificationToken)
+      if (lookup === 'unavailable')
+        throw new DomainVerificationLookupError(
+          503,
+          "We couldn't complete the DNS lookup, so we can't tell yet whether your record is published. Try again in a few minutes — if it keeps failing, check that your domain's nameservers are responding."
+        )
+      if (lookup === 'absent')
+        throw new DomainVerificationLookupError(
+          422,
+          'The verification TXT record was not found yet. DNS changes can take up to 48 hours to propagate — add the record shown and try again.'
+        )
+    }
     const [verifiedElsewhere] = await db
       .select({ organizationId: ssoDomain.organizationId })
       .from(ssoDomain)
@@ -306,7 +312,10 @@ export const verifyOrganizationDomain = defineOrganizationConfigurationUseCase({
           resourceType: AuditResourceType.ORGANIZATION,
           resourceId: input.organizationId,
           description: `Verified domain ${result.domain.domain}`,
-          metadata: { domain: result.domain.domain },
+          metadata: {
+            domain: result.domain.domain,
+            verificationMethod: requiresDomainDnsVerification() ? 'dns' : 'operator',
+          },
         }
       : undefined,
 })

apps/sim/lib/organizations/application/security-settings.test.ts

@@ -13,6 +13,7 @@ import {
   billingSubscriptionMock,
   billingSubscriptionMockFns,
 } from '@sim/testing/mocks/billing-subscription.mock'
+import { resetEnvMock, setEnv } from '@sim/testing/mocks/env.mock'
 import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing/mocks/env-flags.mock'
 import { permissionGroupsResolveMock } from '@sim/testing/mocks/permission-groups-resolve.mock'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -55,6 +56,7 @@ const mocks = {
 
 setEnvFlags({ isBillingEnabled: true })
 afterAll(resetEnvFlagsMock)
+afterAll(resetEnvMock)
 
 const delegated: OrganizationDelegatedPrincipal = {
   kind: 'organization_delegated',
@@ -81,6 +83,8 @@ const row = {
 }
 beforeEach(() => {
   resetDbChainMock()
+  setEnvFlags({ isHosted: false, isBillingEnabled: true })
+  setEnv({ SSO_SKIP_DOMAIN_VERIFICATION: undefined })
   mocks.enterprise.mockResolvedValue(true)
   mocks.dns.mockResolvedValue('present')
 })
@@ -123,31 +127,35 @@ describe('organization domain Settings operations', () => {
     ).rejects.toThrow()
     expect(dbChainMockFns.select).not.toHaveBeenCalled()
   })
-  it('keeps all mutations administrator-only', async () => {
-    queueTableRows(member, [{ role: 'member' }])
-    queueTableRows(member, [{ role: 'member' }])
-    queueTableRows(member, [{ role: 'member' }])
-    await expect(
-      addOrganizationDomain.execute({
-        principal: delegated,
-        input: { organizationId: 'org', domain: 'example.com' },
-      })
-    ).rejects.toThrow('administrator')
-    await expect(
-      verifyOrganizationDomain.execute({
-        principal: delegated,
-        input: { organizationId: 'org', domainId: 'domain' },
-      })
-    ).rejects.toThrow('administrator')
-    await expect(
-      removeOrganizationDomain.execute({
-        principal: delegated,
-        input: { organizationId: 'org', domainId: 'domain' },
-      })
-    ).rejects.toThrow('administrator')
-    expect(mocks.dns).not.toHaveBeenCalled()
-    expect(dbChainMockFns.insert).not.toHaveBeenCalled()
-  })
+  it.each([undefined, 'true'])(
+    'keeps all mutations administrator-only with DNS bypass %s',
+    async (skip) => {
+      setEnv({ SSO_SKIP_DOMAIN_VERIFICATION: skip })
+      queueTableRows(member, [{ role: 'member' }])
+      queueTableRows(member, [{ role: 'member' }])
+      queueTableRows(member, [{ role: 'member' }])
+      await expect(
+        addOrganizationDomain.execute({
+          principal: delegated,
+          input: { organizationId: 'org', domain: 'example.com' },
+        })
+      ).rejects.toThrow('administrator')
+      await expect(
+        verifyOrganizationDomain.execute({
+          principal: delegated,
+          input: { organizationId: 'org', domainId: 'domain' },
+        })
+      ).rejects.toThrow('administrator')
+      await expect(
+        removeOrganizationDomain.execute({
+          principal: delegated,
+          input: { organizationId: 'org', domainId: 'domain' },
+        })
+      ).rejects.toThrow('administrator')
+      expect(mocks.dns).not.toHaveBeenCalled()
+      expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+    }
+  )
   it('does not give non-enterprise members any domains or proof', async () => {
     queueTableRows(member, [{ role: 'member' }])
     mocks.enterprise.mockResolvedValue(false)
@@ -196,6 +204,66 @@ describe('organization domain Settings operations', () => {
     expect(dbChainMockFns.update).not.toHaveBeenCalled()
     expect(mocks.audit).not.toHaveBeenCalled()
   })
+  it.each(['absent', 'unavailable'])(
+    'accepts a self-hosted administrator claim without %s DNS',
+    async (lookup) => {
+      setEnv({ SSO_SKIP_DOMAIN_VERIFICATION: 'true' })
+      queueTableRows(member, [{ role: 'admin' }])
+      queueTableRows(ssoDomain, [row])
+      queueTableRows(ssoDomain, [])
+      mocks.dns.mockResolvedValue(lookup)
+      dbChainMockFns.returning.mockResolvedValueOnce([{ ...row, status: 'verified' }])
+
+      const result = await verifyOrganizationDomain.execute({
+        principal,
+        input: { organizationId: 'org', domainId: 'domain' },
+      })
+
+      expect(result.verified).toBe(true)
+      expect(mocks.dns).not.toHaveBeenCalled()
+    }
+  )
+  it.each([
+    { hosted: true, skip: 'true', lookup: 'absent', status: 422 },
+    { hosted: true, skip: 'true', lookup: 'unavailable', status: 503 },
+    { hosted: false, skip: undefined, lookup: 'absent', status: 422 },
+    { hosted: false, skip: 'false', lookup: 'unavailable', status: 503 },
+  ])(
+    'requires DNS proof with hosted=$hosted and skip=$skip',
+    async ({ hosted, skip, lookup, status }) => {
+      setEnvFlags({ isHosted: hosted })
+      setEnv({ SSO_SKIP_DOMAIN_VERIFICATION: skip })
+      queueTableRows(member, [{ role: 'admin' }])
+      queueTableRows(ssoDomain, [row])
+      queueTableRows(ssoDomain, [])
+      dbChainMockFns.returning.mockResolvedValueOnce([{ ...row, status: 'verified' }])
+      mocks.dns.mockResolvedValue(lookup)
+
+      await expect(
+        verifyOrganizationDomain.execute({
+          principal,
+          input: { organizationId: 'org', domainId: 'domain' },
+        })
+      ).rejects.toMatchObject({ status })
+      expect(dbChainMockFns.update).not.toHaveBeenCalled()
+      expect(mocks.audit).not.toHaveBeenCalled()
+    }
+  )
+  it('refuses a domain owned by another organization even with DNS bypass', async () => {
+    setEnv({ SSO_SKIP_DOMAIN_VERIFICATION: 'true' })
+    queueTableRows(member, [{ role: 'admin' }])
+    queueTableRows(ssoDomain, [row])
+    queueTableRows(ssoDomain, [{ organizationId: 'other' }])
+
+    await expect(
+      verifyOrganizationDomain.execute({
+        principal,
+        input: { organizationId: 'org', domainId: 'domain' },
+      })
+    ).rejects.toThrow('already verified by another organization')
+    expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    expect(mocks.audit).not.toHaveBeenCalled()
+  })
 })
 
 describe('organization session revocation', () => {

helm/sim/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.11.5
+version: 1.11.6
 appVersion: "v0.8.26"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai

helm/sim/values.schema.json

@@ -167,6 +167,10 @@
               "type": "string",
               "description": "Comma-separated CIDRs or IPs on a private network that outbound requests may reach (e.g. '10.0.0.0/8'). Cloud metadata endpoints stay blocked regardless. Ignored on the hosted platform."
             },
+            "SSO_SKIP_DOMAIN_VERIFICATION": {
+              "type": "string",
+              "description": "Set to 'true' to trust organization administrator domain claims without DNS proof on self-hosted deployments. Off by default and ignored on Sim Cloud."
+            },
             "SSO_TRUSTED_PROVIDER_IDS": {
               "type": "string",
               "description": "Comma-separated SSO provider IDs to trust for automatic account linking when an SSO sign-in matches an existing account's email. Only needed for IdPs that do not assert email_verified. Merged into Better Auth accountLinking.trustedProviders."

helm/sim/values.yaml

@@ -254,6 +254,9 @@ app:
     # Set to "true" AFTER running the SSO registration script
     SSO_ENABLED: ""                                       # Enable SSO authentication ("true" to enable)
     NEXT_PUBLIC_SSO_ENABLED: ""                           # Show SSO login button in UI ("true" to enable)
+    # Self-hosted only: trust every organization owner/admin to verify domains without DNS proof.
+    # Requires a compatible app image; see https://docs.sim.ai/platform/enterprise/verified-domains#skip-dns-verification
+    SSO_SKIP_DOMAIN_VERIFICATION: ""                      # Opt in with "true"; unset/"false" requires DNS
     # SSO_TRUSTED_PROVIDER_IDS: comma-separated SSO provider IDs to trust for automatic account linking when a
     # user signs in via SSO and an account with the same email already exists. Only needed for IdPs that do NOT
     # assert email_verified (trustEmailVerified already handles those that do). Resolved at startup — restart after editing.