What does the Domain Whitelist feature in Marketing Cloud actually do?

Question

I'm trying to figure out what the new Domain Whitelist for CloudPages actually does (in Setup > Security > Domain Whitelist).

I attended a Dreamforce '19 session which had a slide on this feature, which explained:

Protects CloudPage-created websites from malicious actors using URLs that redirect customers to unapproved sites.

There is a 'Learn More' link on the page which goes to a 404 error page and I can't find any documentation on this feature.

I would assume that this would only display the CloudPage landing page if the HTTP Referer Header is from a whitelisted domain. However, I've tested that and it's not the case. If I:

1. Create a new page at mydomain.com with a link to a CloudPage
2. Click on the Link
3. Inspect the request headers to see that the Referer URL is https://mydomain.com/cp-test.html

...then the link works even if mydomain.com is not part of the whitelist.

Can someone clarify what this feature actually does?

Answer 1

Domain whitelist is intended to store domains to which you can perform redirects on form submission in Cloud Pages or in Smart Capture forms. Let's say you host a form on Cloud Page hosted on e.g. marketing.ampscript.guide and want it to redirect to sprignaturemoves.com, your form submission will fail, if domain whitelisting is enabled, but sprignaturemoves.com is not added to the list of whitelisted domains. Same with Smart Capture forms hosted outside of Cloud Pages.

So it is indeed the other way around from what you were testing, it is not inbound validation (checking HTTP Referer Header), but outbound validation (checking the destination domain of a redirect).