made leading OU optional for domain check