Second pass

Do not mutate the domain when emitting the error on the top-level
domain. Instead, use a process-wide flag.