Verifying an Organisation by E-mail Domain

The internal provider verifies affiliation by proving the user controls a mailbox at an approved domain. It is the natural choice for organisation verification, and for student and staff checks where you already know the domains. It needs no third-party account and costs nothing.

How it works for the user

They enter an e-mail address at their organisation.
If the domain is not on your list they are told immediately.
Otherwise a one-time link is e-mailed to that address.
Clicking the link within the timeout completes the verification.

Setting the allowed domains

Enter domains separated by semicolons. A leading asterisk is a wildcard, and it includes the dot — *.ac.uk matches cam.ac.uk but not a bare ac.uk. Everything else is matched exactly, ignoring case.

nhs.net;*.nhs.uk
*.ac.uk;*.sch.uk;*.edu

An empty list matches nothing. "No rule set" must never mean "everyone qualifies" for a verification decision, which is why a type using this provider cannot be enabled without at least one domain.

Review the suggested lists before enabling

The Student and Healthcare Worker types arrive with starting domain lists as a convenience. A domain list is an access-control rule, so treat it as one. *.edu in particular is far broader than most businesses intend — it covers every institution in the United States, not only the ones you had in mind.

A verification link is not a login link

Clicking a verification link does not sign the user in. It proves control of a mailbox and nothing more, so a link that is forwarded or leaked cannot become an account takeover.

What it does and does not prove

It proves the user can read mail at that domain. It does not prove their role, their seniority, or that they still work there on the day you rely on it — which is exactly why validity periods matter.

Worked Examples

University discount: list the specific institutions you have agreements with rather than *.edu.
NHS pricing: nhs.net;*.nhs.uk covers the great majority of NHS staff.
Client portal: a custom type per client, each with that client's own domain.