# Domain verification > Depth-first rabbithole dossier for Domain verification; source-anchored research pack. Parent: [Atlas Federated Authentication](https://llms-explorer.com/tree/atlas-federated-authentication/) · 3 facets · 12 facts · page: https://llms-explorer.com/tree/domain-verification/ ## How it works - [medium] When a single domain is mapped to multiple Identity Providers (IdPs), users logging in via the MongoDB Cloud console are automatically redirected to the IdP associated with the first SAML IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` - [low] To use an alternative Identity Provider (IdP) when a domain is mapped to multiple IdPs, users must log in through an SP-initiated or IdP-initiated login URL. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [high] To map a domain to an Identity Provider (IdP) in Atlas Federated Authentication, you must verify domain ownership using either an HTML file upload or a DNS TXT record, and the chosen verification method cannot be modified without deleting and recreating the domain mapping. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md, https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-MongoDB-Cloud.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` - [low] The Domains screen displays both unverified and verified domains mapped to an IdP, and Atlas indicates verification success or failure via a banner at the top of the screen. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` - [low] You cannot delete a domain mapping if it is associated with an Identity Provider (IdP). Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` ## Facts and statements - [medium] To avoid potential security vulnerabilities, you must delete the provided verification record file after domain verification completes. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#antipatterns` - [low] DNS TXT records used for domain verification are public and can be exploited by security researchers to map companies using Atlas by searching for "mongodb-site-verification". Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8703 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#antipatterns` - [medium] For HTML file verification, you must download the `mongodb-site-verification.html` file from Atlas, upload it to your domain, and ensure it is accessible at `/mongodb-site-verification.html`. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` - [low] Once an IdP is linked to Atlas, it appears as Inactive in the Federation Management Console until at least one domain is mapped to it. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` - [low] Atlas routes users with email addresses using mapped domains to the associated Identity Provider (IdP). Sources: https://www.mongodb.com/docs/atlas/security/federated-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` - [low] If a domain is mapped correctly, users are redirected to the Identity Provider (IdP) for authentication and then back to Atlas upon successful authentication. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` - [low] To test domain mapping, enter a username (usually an email address) with the verified domain, such as `user@example.test` for the domain `mongodb.com`. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/domain-verification-7a2e2d53b3/rabbithole-synthesis.md#core` ## Related concepts - Domain — is a part of Domain verification - verification — is a part of Domain verification