JavaScript Document domain Property

Beginner
5 min read
Updated: Nov 2026
3 examples
Property

Definition

Document.domain gets/sets the domain portion of the origin of the current document, as used by the same-origin policy (MDN).

Read the notes below before you get or set this property. Prefer feature detection when support is limited.

Syntax

Use document.domain. Start with this line.

JavaScript
document.domain
CallWhat it does
document.domainPrimary signature.

Built into the browser. Read or assign document.domain — no import required.

Library declarations
JavaScript
document.domain

Parameters

ParameterDescription
Modern pathRequired. location.hostname / postMessage

Return Value

Return ValueDescription
*The current value of document.domain.

JavaScript Examples

Example 1 — Read document.domain

MDN-style getter — useful only for understanding legacy code.

JavaScript
const currentDomain = document.domain;
console.log(currentDomain);
// e.g. "developer.mozilla.org" on MDN
Try It Yourself

How It Works

  1. Read the getter. Returns the domain portion of the origin.
  2. Usual value. Often the hostname from the page URL.
  3. Opaque origins. Pages like data: may return "" (MDN).
  4. Still deprecated. Prefer location.hostname in new code.

Example 2 — Prefer location.hostname

MDN’s recommended way to read the host without document.domain.

JavaScript
const currentHostname = location.hostname;
console.log(currentHostname);
console.log(document.domain === location.hostname);
Try It Yourself

How It Works

  1. Use Location. location.hostname is the modern host string.
  2. Compare optionally. Often matches document.domain when the setter was never used.
  3. Avoid the deprecated API. You can skip document.domain entirely.
  4. Need the port? Use location.host (hostname + port).

Example 3 — Invalid Set Throws SecurityError

Educational only — shows why random domains cannot be assigned.

JavaScript
try {
  // Not a parent of the current hostname → should fail
  document.domain = "not-a-parent.example";
  console.log("unexpected: set succeeded");
} catch (err) {
  console.log(err.name);  // "SecurityError"
}
console.log("Prefer postMessage — do not use the setter");
Try It Yourself

How It Works

  1. Attempt a bad set. Value must be the current host or a parent domain (MDN).
  2. Catch SecurityError. Sandboxes and invalid values throw.
  3. Do not “fix” it. Even valid sets are deprecated and insecure.
  4. Migrate. Use postMessage for intentional cross-origin talk.

Browser Support

Document.domain is Deprecated (MDN). Engines may still expose the getter/setter for legacy pages, but new code should not depend on it.

✓ Deprecated · Avoid setter

Document.domain

Legacy origin domain getter/setter — prefer location.hostname and postMessage.

Legacy Avoid in new apps
Google Chrome Supported · Desktop & Mobile
Full support
Mozilla Firefox Supported · Desktop & Mobile
Full support
Apple Safari Supported · macOS & iOS
Full support
Microsoft Edge Supported · Chromium
Full support
Internet Explorer No native support · Use a polyfill
Polyfill
Opera Supported · Modern versions
Full support
Samsung Internet Supported · Android
Full support
Android WebView Supported · Modern WebView
Full support
domain Deprecated

Bottom line: Safe to recognize in old code. For production features: read hosts with location.hostname, and use postMessage for cross-origin communication.

Frequently Asked Questions

It gets or sets the domain portion of the document’s origin used by the same-origin policy. The getter usually returns the hostname; the setter was historically used to relax subdomain boundaries.
Yes. MDN marks Document.domain as Deprecated. Avoid it in new code. Prefer location.hostname to read the host, and Window.postMessage for controlled cross-origin communication.
MDN: the getter is not dangerous in the same way as the setter, but location.hostname is simpler and lets you avoid document.domain entirely.
MDN: it undermines same-origin protections, can expose the DOM across subdomains, drops the port from the origin model, and is especially risky on shared hosting.
Use Window.postMessage to send asynchronous messages between origins. That controlled message-passing is much safer than blanket DOM access via document.domain (MDN).
MDN: a SecurityError DOMException for sandboxed documents, no browsing context, null effective domain, or values that are not the current hostname or a parent domain.

Next: embeds

Learn the Document collection of embedded objects.

embeds tutorial →

About the author

Mari Selvan M P
Mari Selvan M P 🔗

Developer, cloud engineer, and technical writer

  • Experience 12 years building web and cloud systems
  • Focus Full Stack Development, AWS, and Developer Education

I write practical tutorials so students and working developers can learn by doing—from databases and APIs to deployment on AWS.

11 people found this page helpful