diff --git a/src/app/Discount.php b/src/app/Discount.php
index 8a9e9852..3917961e 100644
--- a/src/app/Discount.php
+++ b/src/app/Discount.php
@@ -1,71 +1,81 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Discount.
  *
  * @property bool   $active
  * @property string $code
  * @property string $description
  * @property int    $discount
  * @property int    $tenant_id
  */
 class Discount extends Model
 {
     use HasTranslations;
 
     public $incrementing = false;
     protected $keyType = 'string';
 
     protected $casts = [
         'discount' => 'integer',
     ];
 
     protected $fillable = [
         'active',
         'code',
         'description',
         'discount',
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'description',
     ];
 
     /**
      * Discount value mutator
      *
      * @throws \Exception
      */
     public function setDiscountAttribute($discount)
     {
         $discount = (int) $discount;
 
         if ($discount < 0) {
             \Log::warning("Expecting a discount rate >= 0");
             $discount = 0;
         }
 
         if ($discount > 100) {
             \Log::warning("Expecting a discount rate <= 100");
             $discount = 100;
         }
 
         $this->attributes['discount'] = $discount;
     }
 
+    /**
+     * The tenant for this discount.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function tenant()
+    {
+        return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
+    }
+
     /**
      * List of wallets with this discount assigned.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 }
diff --git a/src/app/Domain.php b/src/app/Domain.php
index a66db419..99d2b272 100644
--- a/src/app/Domain.php
+++ b/src/app/Domain.php
@@ -1,454 +1,464 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Domain.
  *
  * @property string $namespace
  * @property int    $status
  * @property int    $tenant_id
  * @property int    $type
  */
 class Domain extends Model
 {
     use SoftDeletes;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // ownership of the domain has been confirmed
     public const STATUS_CONFIRMED  = 1 << 4;
     // domain has been verified that it exists in DNS
     public const STATUS_VERIFIED   = 1 << 5;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 6;
 
     // open for public registration
     public const TYPE_PUBLIC       = 1 << 0;
     // zone hosted with us
     public const TYPE_HOSTED       = 1 << 1;
     // zone registered externally
     public const TYPE_EXTERNAL     = 1 << 2;
 
     public const HASH_CODE = 1;
     public const HASH_TEXT = 2;
     public const HASH_CNAME = 3;
 
     public $incrementing = false;
 
     protected $keyType = 'bigint';
 
     protected $fillable = [
         'namespace',
         'status',
         'type'
     ];
 
     /**
      * Assign a package to a domain. The domain should not belong to any existing entitlements.
      *
      * @param \App\Package $package The package to assign.
      * @param \App\User    $user    The wallet owner.
      *
      * @return \App\Domain Self
      */
     public function assignPackage($package, $user)
     {
         // If this domain is public it can not be assigned to a user.
         if ($this->isPublic()) {
             return $this;
         }
 
         // See if this domain is already owned by another user.
         $wallet = $this->wallet();
 
         if ($wallet) {
             \Log::error(
                 "Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
             );
 
             return $this;
         }
 
         $wallet_id = $user->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $this->id,
                         'entitleable_type' => Domain::class
                     ]
                 );
             }
         }
 
         return $this;
     }
 
     /**
      * The domain entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Return list of public+active domain names (for current tenant)
      */
     public static function getPublicDomains(): array
     {
         return self::withEnvTenant()
             ->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->get(['namespace'])->pluck('namespace')->toArray();
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is confirmed the ownership of.
      *
      * @return bool
      */
     public function isConfirmed(): bool
     {
         return ($this->status & self::STATUS_CONFIRMED) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is registered with us.
      *
      * @return bool
      */
     public function isExternal(): bool
     {
         return ($this->type & self::TYPE_EXTERNAL) > 0;
     }
 
     /**
      * Returns whether this domain is hosted with us.
      *
      * @return bool
      */
     public function isHosted(): bool
     {
         return ($this->type & self::TYPE_HOSTED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is public.
      *
      * @return bool
      */
     public function isPublic(): bool
     {
         return ($this->type & self::TYPE_PUBLIC) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isVerified(): bool
     {
         return ($this->status & self::STATUS_VERIFIED) > 0;
     }
 
     /**
      * Ensure the namespace is appropriately cased.
      */
     public function setNamespaceAttribute($namespace)
     {
         $this->attributes['namespace'] = strtolower($namespace);
     }
 
     /**
      * Domain status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_CONFIRMED,
             self::STATUS_VERIFIED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid domain status: {$status}");
         }
 
         if ($this->isPublic()) {
             $this->attributes['status'] = $new_status;
             return;
         }
 
         if ($new_status & self::STATUS_CONFIRMED) {
             // if we have confirmed ownership of or management access to the domain, then we have
             // also confirmed the domain exists in DNS.
             $new_status |= self::STATUS_VERIFIED;
             $new_status |= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         // if the domain is now active, it is not new anymore.
         if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
             $new_status ^= self::STATUS_NEW;
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Ownership verification by checking for a TXT (or CNAME) record
      * in the domain's DNS (that matches the verification hash).
      *
      * @return bool True if verification was successful, false otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function confirm(): bool
     {
         if ($this->isConfirmed()) {
             return true;
         }
 
         $hash = $this->hash(self::HASH_TEXT);
         $confirmed = false;
 
         // Get DNS records and find a matching TXT entry
         $records = \dns_get_record($this->namespace, DNS_TXT);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         foreach ($records as $record) {
             if ($record['txt'] === $hash) {
                 $confirmed = true;
                 break;
             }
         }
 
         // Get DNS records and find a matching CNAME entry
         // Note: some servers resolve every non-existing name
         // so we need to define left and right side of the CNAME record
         // i.e.: kolab-verify IN CNAME <hash>.domain.tld.
         if (!$confirmed) {
             $cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
             $records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);
 
             if ($records === false) {
                 throw new \Exception("Failed to get DNS record for {$this->namespace}");
             }
 
             foreach ($records as $records) {
                 if ($records['target'] === $cname) {
                     $confirmed = true;
                     break;
                 }
             }
         }
 
         if ($confirmed) {
             $this->status |= Domain::STATUS_CONFIRMED;
             $this->save();
         }
 
         return $confirmed;
     }
 
     /**
      * Generate a verification hash for this domain
      *
      * @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
      *
      * @return string Verification hash
      */
     public function hash($mod = null): string
     {
         $cname = 'kolab-verify';
 
         if ($mod === self::HASH_CNAME) {
             return $cname;
         }
 
         $hash = \md5('hkccp-verify-' . $this->namespace);
 
         return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Domain::STATUS_SUSPENDED;
         $this->save();
     }
 
+    /**
+     * The tenant for this domain.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function tenant()
+    {
+        return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
+    }
+
     /**
      * Unsuspend this domain.
      *
      * The domain is unsuspended through either of the following courses of actions;
      *
      *   * The account balance has been topped up, or
      *   * a suspected spammer has resolved their issues, or
      *   * the command-line is triggered.
      *
      * Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
      * access to have been confirmed before.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Domain::STATUS_SUSPENDED;
 
         if ($this->isConfirmed() && $this->isVerified()) {
             $this->status |= Domain::STATUS_ACTIVE;
         }
 
         $this->save();
     }
 
     /**
      * Verify if a domain exists in DNS
      *
      * @return bool True if registered, False otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function verify(): bool
     {
         if ($this->isVerified()) {
             return true;
         }
 
         $records = \dns_get_record($this->namespace, DNS_ANY);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         // It may happen that result contains other domains depending on the host DNS setup
         // that's why in_array() and not just !empty()
         if (in_array($this->namespace, array_column($records, 'host'))) {
             $this->status |= Domain::STATUS_VERIFIED;
             $this->save();
 
             return true;
         }
 
         return false;
     }
 
     /**
      * Returns the wallet by which the domain is controlled
      *
      * @return \App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         // Note: Not all domains have a entitlement/wallet
         $entitlement = $this->entitlement()->withTrashed()->first();
 
         return $entitlement ? $entitlement->wallet : null;
     }
 }
diff --git a/src/app/Group.php b/src/app/Group.php
index 77115c3e..d826c9e1 100644
--- a/src/app/Group.php
+++ b/src/app/Group.php
@@ -1,281 +1,292 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Group.
  *
- * @property int    $id      The group identifier
- * @property string $email   An email address
- * @property string $members A comma-separated list of email addresses
- * @property int    $status  The group status
+ * @property int    $id        The group identifier
+ * @property string $email     An email address
+ * @property string $members   A comma-separated list of email addresses
+ * @property int    $status    The group status
+ * @property int    $tenant_id Tenant identifier
  */
 class Group extends Model
 {
     use SoftDeletes;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
 
     public $incrementing = false;
 
     protected $keyType = 'bigint';
 
     protected $fillable = [
         'email',
         'status',
         'members'
     ];
 
     /**
      * Assign the group to a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return \App\Group Self
      * @throws \Exception
      */
     public function assignToWallet(Wallet $wallet): Group
     {
         if (empty($this->id)) {
             throw new \Exception("Group not yet exists");
         }
 
         if ($this->entitlement()->count()) {
             throw new \Exception("Group already assigned to a wallet");
         }
 
         $sku = \App\Sku::where('title', 'group')->first();
         $exists = $wallet->entitlements()->where('sku_id', $sku->id)->count();
 
         \App\Entitlement::create([
             'wallet_id' => $wallet->id,
             'sku_id' => $sku->id,
             'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
             'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
             'entitleable_id' => $this->id,
             'entitleable_type' => Group::class
         ]);
 
         return $this;
     }
 
     /**
      * Returns group domain.
      *
      * @return ?\App\Domain The domain group belongs to, NULL if it does not exist
      */
     public function domain(): ?Domain
     {
         list($local, $domainName) = explode('@', $this->email);
 
         return Domain::where('namespace', $domainName)->first();
     }
 
     /**
      * Find whether an email address exists as a group (including deleted groups).
      *
      * @param string $email        Email address
      * @param bool   $return_group Return Group instance instead of boolean
      *
      * @return \App\Group|bool True or Group model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_group = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $group = self::withTrashed()->where('email', $email)->first();
 
         if ($group) {
             return $return_group ? $group : true;
         }
 
         return false;
     }
 
     /**
      * The group entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Group members propert accessor. Converts internal comma-separated list into an array
      *
      * @param string $members Comma-separated list of email addresses
      *
      * @return array Email addresses of the group members, as an array
      */
     public function getMembersAttribute($members): array
     {
         return $members ? explode(',', $members) : [];
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Ensure the email is appropriately cased.
      *
      * @param string $email Group email address
      */
     public function setEmailAttribute(string $email)
     {
         $this->attributes['email'] = strtolower($email);
     }
 
     /**
      * Ensure the members are appropriately formatted.
      *
      * @param array $members Email addresses of the group members
      */
     public function setMembersAttribute(array $members): void
     {
         $members = array_unique(array_filter(array_map('strtolower', $members)));
 
         sort($members);
 
         $this->attributes['members'] = implode(',', $members);
     }
 
     /**
      * Group status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid group status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Suspend this group.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
+    /**
+     * The tenant for this group.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function tenant()
+    {
+        return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
+    }
+
     /**
      * Unsuspend this group.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Returns the wallet by which the group is controlled
      *
      * @return \App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         // Note: Not all domains have a entitlement/wallet
         $entitlement = $this->entitlement()->withTrashed()->first();
 
         return $entitlement ? $entitlement->wallet : null;
     }
 }