> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/settings/domains.md).

# Domains

Use **Settings -> Domains** to manage external domain scope.

<figure><img src="/files/JJjPcAuVnFWirr21HPlM" alt=""><figcaption></figcaption></figure>

## Whitelist

The whitelist is the allow-list for external discovery and assessment. Add domains that are approved for testing.

Examples:

```
example.com
*.example.com
*.dev.example.com
```

Use the whitelist to keep discovered related domains inside approved scope.

Domain scope controls which domains are allowed. Domain ownership verification is handled separately in **Settings -> Domain Verification**.

{% content-ref url="/pages/KbaSIgSbMUURkiHIWkMl" %}
[Domain Verification](/enterprise/settings/domain-verification.md)
{% endcontent-ref %}

## Blacklist

The blacklist blocks domains even if they would otherwise be included by discovery or whitelist rules.

Examples:

```
analytics.example.com
*.third-party.example
payments-vendor.com
```

Use the blacklist for:

* third-party services;
* production areas excluded from the engagement;
* domains owned by partners or vendors;
* targets that must not receive automated traffic.

## Rule Precedence

Blacklist takes precedence over whitelist.

If `*.example.com` is whitelisted and `billing.example.com` is blacklisted, `billing.example.com` is excluded.

## Before a Scan

Confirm:

* every intended root domain is listed;
* excluded third-party domains are blacklisted;
* wildcard rules do not accidentally include unrelated assets;
* scheduled scans still match the current domain policy.