additional security check on getDomain()