handle matching: compare against domain, not ip