diff --git a/crates/claims/crates/data-integrity/core/src/options.rs b/crates/claims/crates/data-integrity/core/src/options.rs
index 0ed4e670e..a29ee313a 100644
--- a/crates/claims/crates/data-integrity/core/src/options.rs
+++ b/crates/claims/crates/data-integrity/core/src/options.rs
@@ -40,8 +40,9 @@ pub struct ProofOptions<M, T> {
     /// Example domain values include: `domain.example`` (DNS domain),
     /// `https://domain.example:8443` (Web origin), `mycorp-intranet` (bespoke
     /// text string), and `b31d37d4-dd59-47d3-9dd8-c973da43b63a` (UUID).
-    #[serde(default, skip_serializing_if = "Vec::is_empty", rename = "domain")]
-    pub domains: Vec<String>,
+    // #[serde(default, skip_serializing_if = "Vec::is_empty", rename = "domain")]
+    #[serde(default, rename = "domain")]
+    pub domains: String,
 
     /// Used to mitigate replay attacks.
     ///
@@ -78,7 +79,7 @@ impl<M, T: Default> Default for ProofOptions<M, T> {
             verification_method: None,
             proof_purpose: ProofPurpose::default(),
             expires: None,
-            domains: Vec::new(),
+            domains: String::default(),
             challenge: None,
             nonce: None,
             options: Default::default(),
@@ -100,7 +101,7 @@ impl<M, T> ProofOptions<M, T> {
             verification_method: Some(verification_method),
             proof_purpose,
             expires: None,
-            domains: Vec::new(),
+            domains: String::default(),
             challenge: None,
             nonce: None,
             options,
@@ -115,7 +116,7 @@ impl<M, T> ProofOptions<M, T> {
             verification_method: Some(verification_method),
             proof_purpose: ProofPurpose::default(),
             expires: None,
-            domains: Vec::new(),
+            domains: String::default(),
             challenge: None,
             nonce: None,
             options,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs b/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs
index 0e6fe7146..a12a604bc 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs
@@ -57,8 +57,9 @@ pub struct ProofConfiguration<S: CryptographicSuite> {
     /// Example domain values include: `domain.example`` (DNS domain),
     /// `https://domain.example:8443` (Web origin), `mycorp-intranet` (bespoke
     /// text string), and `b31d37d4-dd59-47d3-9dd8-c973da43b63a` (UUID).
-    #[serde(skip_serializing_if = "Vec::is_empty", rename = "domain")]
-    pub domains: Vec<String>,
+    // #[serde(skip_serializing_if = "Vec::is_empty", rename = "domain")]
+    #[serde(rename = "domain")]
+    pub domains: String,
 
     /// Used to mitigate replay attacks.
     ///
@@ -102,7 +103,7 @@ impl<S: CryptographicSuite> ProofConfiguration<S> {
             verification_method,
             proof_purpose,
             expires: None,
-            domains: Vec::new(),
+            domains: String::default(),
             challenge: None,
             nonce: None,
             options,
@@ -122,7 +123,7 @@ impl<S: CryptographicSuite> ProofConfiguration<S> {
             verification_method,
             proof_purpose: ProofPurpose::default(),
             expires: None,
-            domains: Vec::new(),
+            domains: String::default(),
             challenge: None,
             nonce: None,
             options,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs b/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs
index 4182f24a7..f45d1088e 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs
@@ -30,8 +30,8 @@ pub struct ProofConfigurationRef<'a, S: CryptographicSuite> {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub expires: Option<xsd_types::DateTimeStamp>,
 
-    #[serde(skip_serializing_if = "<[String]>::is_empty", rename = "domain")]
-    pub domains: &'a [String],
+    #[serde(rename = "domain")]
+    pub domains: &'a str,
 
     #[serde(skip_serializing_if = "Option::is_none")]
     pub challenge: Option<&'a str>,
@@ -151,8 +151,8 @@ pub struct ProofConfigurationRefWithoutOptions<'a, S: CryptographicSuite> {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub expires: Option<xsd_types::DateTimeStamp>,
 
-    #[serde(skip_serializing_if = "<[String]>::is_empty", rename = "domain")]
-    pub domains: &'a [String],
+    #[serde(rename = "domain")]
+    pub domains: &'a str,
 
     #[serde(skip_serializing_if = "Option::is_none")]
     pub challenge: Option<&'a str>,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/mod.rs b/crates/claims/crates/data-integrity/core/src/proof/mod.rs
index 16c138d9c..7d44eea63 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/mod.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/mod.rs
@@ -81,8 +81,8 @@ pub struct Proof<S: CryptographicSuite> {
     /// Example domain values include: `domain.example`` (DNS domain),
     /// `https://domain.example:8443` (Web origin), `mycorp-intranet` (bespoke
     /// text string), and `b31d37d4-dd59-47d3-9dd8-c973da43b63a` (UUID).
-    #[serde(skip_serializing_if = "Vec::is_empty", rename = "domain")]
-    pub domains: Vec<String>,
+    #[serde(rename = "domain")]
+    pub domains: String,
 
     /// Used to mitigate replay attacks.
     ///
@@ -132,7 +132,7 @@ impl<T: CryptographicSuite> Proof<T> {
             verification_method,
             proof_purpose,
             expires: None,
-            domains: Vec::new(),
+            domains: String::default(),
             challenge: None,
             nonce: None,
             options,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/reference.rs b/crates/claims/crates/data-integrity/core/src/proof/reference.rs
index f5278d4bc..28c956bb3 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/reference.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/reference.rs
@@ -17,7 +17,7 @@ pub struct ProofRef<'a, S: CryptographicSuite> {
 
     pub expires: Option<xsd_types::DateTimeStamp>,
 
-    pub domains: &'a [String],
+    pub domains: &'a str,
 
     pub challenge: Option<&'a str>,
 
diff --git a/crates/claims/crates/data-integrity/core/src/suite/configuration.rs b/crates/claims/crates/data-integrity/core/src/suite/configuration.rs
index ccc3b7624..2c47b5d3a 100644
--- a/crates/claims/crates/data-integrity/core/src/suite/configuration.rs
+++ b/crates/claims/crates/data-integrity/core/src/suite/configuration.rs
@@ -32,6 +32,9 @@ pub enum ConfigurationError {
     #[error("invalid option `{0}`")]
     InvalidOption(String),
 
+    #[error("missing domain")]
+    MissingDomain,
+
     #[error("{0}")]
     Other(String),
 }
diff --git a/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs b/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs
index e00cd9a33..d67dd17a9 100644
--- a/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs
+++ b/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs
@@ -76,7 +76,7 @@ where
         verification_method: base_proof.verification_method.cloned(),
         proof_purpose: base_proof.proof_purpose,
         expires: base_proof.expires,
-        domains: base_proof.domains.to_vec(),
+        domains: base_proof.domains.to_string(),
         challenge: base_proof.challenge.map(ToOwned::to_owned),
         nonce: base_proof.nonce.map(ToOwned::to_owned),
         options: *base_proof.options,