Your domain: line missed half the spam.

Your domain: line missed half the spam.

The myth: domain:example.com covers everything on that site.

Actually, Google's documentation says a domain: entry covers the domain and its subdomains — but operators still get burned on edge cases: protocol-relative pastes, IDN/punycode mismatches, and listing www. as if it were a separate domain when it isn't.

Reality: the failure is rarely scope and usually formatting. A line like domain:www.example.com or domain:http://example.com is malformed and risks being ignored — so the real spam slips through while you think it's handled.

The failure mode is trusting your mental model of the syntax instead of the exact spec.

The fix: write the bare registrable domain — domain:example.com, no protocol, no www., no path. Convert IDNs to punycode. Verify each line parses.

Reality check: the spec is literal — write it literally.