---
title: Override Blocked Domains with a Domain Allow List
canonical: https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/override-blocked-domains-with-a-domain-allow-list/
product: CloudConnexa Docs
description: Configure a Domain Allow List in a CloudConnexa Shield Policy to ensure specific domains are always accessible, even if a content category blocks them— add domains manually or via .txt upload, search and download the list, and manage Block and Allow List interactions.
keywords: Allow List, domain filtering, content categories, domain allowlist, Cyber Shield, Shield Policy
---

# Override Blocked Domains with a Domain Allow List

## Overview

Configure a **Domain Allow List** per Shield Policy to make specific domains always allowed for users covered by that policy. On the policy's Domain Allow List tab, you can add individual domains or use a `.txt` file for batch upload.

An allow-listed domain remains always accessible even when its content category is blocked by the policy's Domain Filtering configuration. The Domain Allow List works only while **Domain Filtering** is on for the policy.

Each Domain Allow List supports up to 150,000 characters.

For more information about how filtering settings apply per policy, refer to [About Shield Policies](https://openvpn.net/cloud-docs/owner/shield/shield---policies/about-shield-policies.md). To determine which User Groups receive the Allow List settings, refer to [Assign User Groups to a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/assign-user-groups-to-a-shield-policy.md).

## Before you begin

Ensure you have a Shield Policy to configure.

You can configure the **Default Policy** or a custom Shield Policy. To create a custom policy, refer to [Create or Edit a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/create-or-edit-a-shield-policy.md).

## Add domains to the Domain Allow List

Add domains directly when you have a small number of entries to configure.

1. Sign in to your WPC's Administration Portal at your **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Shield → Policies**.
3. Select the **Edit policy** icon for an existing policy with Domain Filtering turned on.
4. Select **Domain Allow List**.
5. Turn on **Enable Allow List**.
6. Enter the domains you want to allow, with one domain per line.
7. Review the list of domains you want to keep always accessible.
8. Select **Save changes**.
   - The Domain Allow List applies to users covered by the Shield Policy.

> **Note**
>
> Changes may not apply immediately to domains that were previously visited because of local caching.

## Upload a Domain Allow List

Use **Upload List** to perform a batch upload of domains from a `.txt` file.

1. Open the Shield Policy and select the **Domain Allow List** tab.
2. Turn on **Enable allow list**, if it isn't already on.
3. Select **Upload List**.
4. Select the `.txt` file containing your Domain Allow List.

   > **Important**
   >
   > **Upload List** replaces the current Domain Allow List. It doesn't append the uploaded domains to the existing list.

   > **Note**
   >
   > The list can contain up to 150,000 characters. Entries must use valid domain formats and ASCII characters.
5. Review the uploaded domains.
6. Save your changes.

## Add a comment to the Domain Allow List

Use `#` to add comments to the Domain Allow List. Comments can help identify or organize groups of domains and aren't treated as domain entries.

1. Open the Shield Policy and select the **Domain Allow List** tab.
2. Add `#` at the beginning of the line (or use `CTRL+` on Windows or `⌘+/` on macOS), followed by your comment. For example:

   ```
   # Corporate applications
   example.com
   internal.example.com

   # Development services
   dev.example.com
   ```
3. Add or edit the domain entries as needed.
4. Save your changes.

   > **Tip**
   >
   > You can include comments when you enter domains directly or in a `.txt` file used with **Upload List**.

## Search the Domain Allow List

Use search to find a domain or comment in the current Domain Allow List.

1. Open the Shield Policy and select the **Domain Allow List** tab.
2. Select anywhere inside the **Allowed Domains** field.
3. Press `Ctrl+F` on Windows or `⌘+F` on macOS.
4. Enter the domain or text you want to find.
5. Use the search bar arrows to move through matching entries.

## Download the Domain Allow List

Use **Download List** to save a copy of the policy's current Domain Allow List.

1. Open the Shield Policy and select the **Domain Allow List** tab.
2. Select **Download List**.
   - `allow-list.txt` downloads the current list.

## Turn the Domain Allow List on or off

Use **Enable allow list** to control whether the policy uses its configured Domain Allow List.

1. Open the Shield Policy and select the **Domain Allow List** tab.
2. Turn **Enable allow list** on or off.
3. Save your changes.
   - Turning off **Enable allow list** retains the configured domains but stops the Allow List from affecting Domain Filtering.

   > **Important**
   >
   > The Domain Allow List works only while **Domain Filtering** is on. If you turn off Domain Filtering for the Shield Policy, **Enable allow list** turns off and is disabled.

## How Domain Allow List and Block List entries match

The **Domain Allow List** and **Domain Block List** use domain name matching to determine whether an entry applies to a domain or its subdomains.

A domain entry applies to that domain and its subdomains. You can create an exception for a specific subdomain by adding it to the opposite list.

### Domain name matching examples

| **Domain Allow List** | **Domain Block List** | **Result** |
| --- | --- | --- |
| `google.com` | — | `google.com` and its subdomains are allowed. |
| `google.com` | `mail.google.com` | `google.com` and its other subdomains are allowed, but `mail.google.com` is blocked. |
| — | `google.com` | `google.com` and its subdomains are blocked. |
| `mail.google.com` | `google.com` | `google.com` and its other subdomains are blocked, but `mail.google.com` is allowed. |

CloudConnexa evaluates domain names from right to left, beginning with the top-level domain (TLD). A more specific subdomain entry on the opposite list overrides the broader parent-domain entry.

### How the lists affect Domain Filtering

The Domain Allow List and Domain Block List also take precedence over the policy's content-category settings:

- A domain on the **Domain Allow List** is always allowed, even if its content category is blocked.
- A domain on the **Domain Block List** is always blocked.

> **Important**
>
> Don't add the same domain to both lists. CloudConnexa reports a conflict when an identical domain appears on both the Domain Allow List and Domain Block List. Remove the domain from one list before saving your changes.

## Resolve Domain Allow List validation errors

If CloudConnexa reports an error or warning, check the Domain Allow List for:

- Invalid domain formats.
- Non-ASCII characters.
- Duplicate domains.
- Domains that are also on the Domain Block List.
- A list that exceeds the 150,000-character limit.

Correct the entries, then save your changes.

## What happens next

Domains on the enabled Domain Allow List are always allowed for users covered by the Shield Policy, even when the domains belong to content categories that the policy blocks.

To always block a specific domain instead, refer to [Domain Block List](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/block-access-to-specific-domain-names-with-a-block-list.md).

> **Tip**
>
> Changes may not apply immediately to previously visited domains because of local caching.

## Related resources

- [About Shield Policies](https://openvpn.net/cloud-docs/owner/shield/shield---policies/about-shield-policies.md)
- [Create or Edit a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/create-or-edit-a-shield-policy.md)
- [Assign User Groups to a Shield Policy](https://openvpn.net/cloud-docs/owner/shield/shield---policies/assign-user-groups-to-a-shield-policy.md)
- [About Cyber Shield](https://openvpn.net/cloud-docs/owner/shield/about-cyber-shield.md)
- [Domain Filtering](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/domain-filtering-protection-levels-and-content-categories.md)
- [Configure Domain Filtering](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/configure-domain-filtering-for-a-shield-policy.md)
- [Domain Block List](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/block-access-to-specific-domain-names-with-a-block-list.md)

---

Prev: [Configure Domain Filtering](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/configure-domain-filtering-for-a-shield-policy.md)
Next: [Domain Block List](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/block-access-to-specific-domain-names-with-a-block-list.md)
Index: https://openvpn.net/cloud-docs/llms.txt