docs: document allowed domains for emails authentication

deploy/emails-authentication.mdx

@@ -73,6 +73,28 @@
   <img src="/images/emails-auth/invite-readers-dark.png" alt="The Invite readers dialog with two acme.com email addresses, the customers and beta groups, and an empty Access until date." className="hidden dark:block" />
 </Frame>
 
+### Allow sign-in by email domain
+
+To let people at a company read your docs without inviting each of them, add their email domains to **Allowed domains** in your [Access settings](https://app.mintlify.com/settings/project/authentication). Enter one domain per line and click **Save**.
+
+```text Allowed domains
+acme.com
+*.acme.com
+```
+
+A domain such as `acme.com` matches `dana@acme.com`. A wildcard such as `*.acme.com` matches subdomains such as `sam@eu.acme.com`, but not `acme.com` itself.
+
+You can't add public email domains such as `gmail.com`, public suffixes such as `co.uk`, or shared mail domains such as `onmicrosoft.com`.
+
+The first time someone with an allowed domain signs in, they click **Email me a code** or **Forgot password?** on the sign-in page:
+
+- **Email me a code**: Mintlify emails a sign-in link instead of a code. Sign-in links expire after 15 minutes.
+- **Forgot password?**: Mintlify emails a link to set a password.
+
+Opening the link adds them as a reader and signs them in.
+
+If you remove a domain from **Allowed domains**, readers who joined through that domain can no longer sign in. Readers you invited keep their access.
+
 ### Import readers from a CSV
 
 To add many readers at once, click **Import CSV** and choose a file with these columns:
@@ -96,14 +118,14 @@
 
 ### Remove a reader
 
 Open the actions menu on the reader's row and click **Remove reader**. Mintlify signs the reader out the next time their session refreshes and they can't sign in again unless you reinvite them.
 
 ## How readers sign in
 
 When someone visits your site, they see a sign-in page with your logo. Depending on the methods you turned on, they can:
 
 - Enter their email and password.
 - Click **Email me a code** and enter the 6-digit code from the email. Codes expire after 10 minutes.
 - Click **Forgot password?** to get a reset link. Reset links expire after one hour and work once.
 
 <Frame>
@@ -112,7 +134,7 @@
 
 Passwords must have at least 12 characters. After 10 failed password attempts, the account locks for 15 minutes. Sessions last seven days, or until the reader's **Access until** date if that comes first.
 
-The sign-in page never reveals whether an email has access. Someone who enters an email that isn't a reader sees the same "Check your email" message, and Mintlify doesn't send an email.
+The sign-in page never reveals whether an email has access. Someone who enters an email that isn't a reader sees the same "Check your email" message, and Mintlify doesn't send an email unless the email's domain is in **Allowed domains**.
 
 ## Control access with groups
 
@@ -139,7 +161,7 @@
 *.acme-partners.com partners
 ```
 
-For example, a rule for `acme.com` matches `dana@acme.com`. A rule for `*.acme-partners.com` matches subdomains such as `sam@eu.acme-partners.com`, but not `acme-partners.com` itself. Domain rules only add groups. People with a matching domain still need an invite to sign in.
+For example, a rule for `acme.com` matches `dana@acme.com`. A rule for `*.acme-partners.com` matches subdomains such as `sam@eu.acme-partners.com`, but not `acme-partners.com` itself. Domain rules only add groups. To let people with a matching domain sign in without an invite, also add the domain to [allowed domains](#allow-sign-in-by-email-domain).
 
 ## Send reader emails from your own domain
 
@@ -161,6 +183,6 @@
   </Step>
 </Steps>
 
 Until your domain is verified, reader emails keep coming from `notifications@mintlify.com`. Each site can have one sending domain, and each domain can belong to only one site. You can't use `mintlify.com` or its subdomains.
 
 To change the sender name, edit it and save. To stop sending from your domain, click **Remove**.