You have a whitelist of possible domains though (Messaging and payments being the most common for now)