They don't need the encrypted payload just domain is the basis here as far as I can tell.