- whitelist handles any subdomain, not just host and domain