allow subdomain in whitelist