domain restrictions