by_domain scope should match the whole domain