A data processing apparatus comprising: processing circuitry for performing data processing operations in response to program instructions, the processing circuitry having a plurality of domains of operation including a secure domain and a less secure domain, wherein when operating in the secure domain the processing circuitry has access to data that is not accessible when operating in the less secure domain; wherein in response to execution of a control flow altering instruction, the processing circuitry is configured to switch to processing a program instruction at a target address indicated by the control flow altering instruction, and to perform domain selection for determining a selected domain in which the processing circuitry is to operate for the program instruction at the target address; and at least if the control flow altering instruction is executed while operating in the secure domain, then the processing circuitry is configured to: (i) perform domain checking for determining which of the plurality of domains are allowed to be the selected domain determined by the domain selection for the program instruction at the target address, the domain checking using a different technique to the domain selection; and (ii) trigger a domain check error if the selected domain determined in the domain selection is not an allowed selected domain determined in the domain checking; characterised in that in response to execution of a control flow altering instruction while operating in the secure domain for which the domain selection determines that the secure domain is the selected domain, the processing circuitry is configured to trigger a domain check error when the secure domain is not an allowed selected domain determined in the domain checking. processing circuitry for performing data processing operations in response to program instructions, the processing circuitry having a plurality of domains of operation including a secure domain and a less secure domain, wherein when operating in the secure domain the processing circuitry has access to data that is not accessible when operating in the less secure domain; wherein in response to execution of a control flow altering instruction, the processing circuitry is configured to switch to processing a program instruction at a target address indicated by the control flow altering instruction, and to perform domain selection for determining a selected domain in which the processing circuitry is to operate for the program instruction at the target address; and at least if the control flow altering instruction is executed while operating in the secure domain, then the processing circuitry is configured to: (i) perform domain checking for determining which of the plurality of domains are allowed to be the selected domain determined by the domain selection for the program instruction at the target address, the domain checking using a different technique to the domain selection; and (ii) trigger a domain check error if the selected domain determined in the domain selection is not an allowed selected domain determined in the domain checking; (i) perform domain checking for determining which of the plurality of domains are allowed to be the selected domain determined by the domain selection for the program instruction at the target address, the domain checking using a different technique to the domain selection; and (ii) trigger a domain check error if the selected domain determined in the domain selection is not an allowed selected domain determined in the domain checking; characterised in that in response to execution of a control flow altering instruction while operating in the secure domain for which the domain selection determines that the secure domain is the selected domain, the processing circuitry is configured to trigger a domain check error when the secure domain is not an allowed selected domain determined in the domain checking.