Resolve SAML email-domain approval issues

Overview

If Ramp says your email domain has not been approved when you sign in with SAML single sign-on (SSO), your Ramp administrator needs to review that domain. Your email domain is the part after @ in your email address, such as example.com.

This guide applies to a domain-approval message, not every SSO failure. For email mismatches, expired certificates, or other errors, see Troubleshooting SSO sign-in issues.

If you cannot sign in with SAML

1. Start from Ramp's sign-in page with the email address associated with your Ramp account.
2. Share the domain-approval message with your Ramp administrator or IT team. Ask them to review the exact domain in your sign-in email, including an external firm's domain if you are a contractor or accountant.
3. Use another sign-in method only if it is already available for your account and permitted by your organization. A password reset does not enable password sign-in when it is disabled. See sign-in controls.

If no permitted method works, or you are the administrator and cannot access settings, follow Contact Ramp Support.

For administrators: review the email domain

You need permission to manage Company security settings. Ask the administrator who manages your security settings to help if you cannot access them. DNS verification also requires someone who can edit the domain's public DNS records.

Check the affected user's exact email domain and SAML provider configuration. Configuring a provider's supported domains and verifying control of a domain are separate steps. DNS verification does not configure the provider or approve a pending sharing request.

Verify a domain your organization controls

If you already have DNS verification instructions from Ramp for the affected business and domain, have your DNS administrator publish the supplied TXT record name and complete value. Follow those instructions to check the record after it becomes publicly available. If you do not have those instructions or cannot access verification for that business, contact Ramp Support before making DNS changes.

Use the exact domain in the affected user's email address. A parent domain and its subdomains are checked separately: verifying example.com does not verify team.example.com. Use the record supplied for this Ramp business and domain, not another business's instructions.

After verification, confirm the correct SAML provider supports the domain, then ask the user to retry from Ramp's sign-in page.

Keep the TXT record in place so Ramp can check it again. You do not need to configure a SAML provider before verifying a company domain.

Use a domain shared with another Ramp business

If another Ramp business already uses the domain for SSO, follow Request to share an SSO domain. Approved sharing is a separate path from DNS verification; a pending request is not approval. Sharing does not replace SAML provider or account eligibility checks. Each business keeps its own provider configuration.

For a domain your organization does not control, work with its administrator. Verifying your company domain does not verify theirs. If neither path applies, contact Ramp Support before changing a working provider configuration.

If DNS verification does not complete

• Missing or mismatched record: Check the exact domain, TXT record name, and complete value against Ramp's instructions. Confirm the record is publicly resolvable.
• Recent DNS change: Retry after the record becomes publicly available. DNS propagation time varies.
• Lookup error: Try again later; an inconclusive lookup does not necessarily mean the record is incorrect.
• Retry limit: Wait before checking again.
• Verification option missing or repeated failure: Confirm you have permission to manage Company security, then contact Ramp Support if you still cannot proceed.

If the domain verifies but sign-in still fails, check the email match and provider configuration using Troubleshooting SSO sign-in issues. Domain verification does not resolve unrelated SSO errors.

Contact Ramp Support

If the steps above do not resolve the issue, see How to contact Ramp's Support team, including contact options if you cannot sign in.

Provide your company name, affected account email, exact error or screenshot, approximate attempt time and time zone, and SSO provider. Include whether an administrator can still sign in and whether the domain is verified or awaiting sharing approval. Do not send passwords, MFA codes, recovery codes, or SAML sign-in responses.