* <p>
     * Specifically, if the SID has
     * been resolved and it is not a domain SID or builtin account,
     * the full DOMAIN\name form of the account will be
     * returned (e.g. MYDOM\alice or MYDOM\Domain Users).
     * If the SID has been resolved but it is is a domain SID,
     * only the domain name will be returned (e.g. MYDOM).
     * If the SID has been resolved but it is a builtin account,

     *            The hostname of the server that should be queried. For maximum efficiency this should be the hostname
     *            of a domain controller however a member server will work as well and a domain controller may not
     *            return names for SIDs corresponding to local accounts for which the domain controller is not an
     *            authority.
     * @param tc

        if (domains == null) {
            return false;
        }
        domain = domain.toLowerCase();
        return domains.get(domain) != null;
    }

    /**
     * Gets a domain controller transport for the specified domain
     * @param domain the domain name
     * @param auth the authentication credentials
     * @return an SMB transport to the domain controller

    /**
     * Construct a relative SID
     *
     * @param domsid the domain SID
     * @param id the SID to append to the domain SID
     */
    public SID(final SID domsid, final SID id) {
        this.revision = domsid.revision;
        this.identifier_authority = domsid.identifier_authority;
        this.sub_authority_count = (byte) (domsid.sub_authority_count + id.sub_authority_count);

            // Default constructor
        }

        /** Domain NetBIOS name. */
        public rpc.unicode_string name;
        /** DNS domain name. */
        public rpc.unicode_string dns_domain;
        /** DNS forest name. */
        public rpc.unicode_string dns_forest;
        /** Domain GUID. */
        public rpc.uuid_t domain_guid;
        /** Domain security identifier. */
        public rpc.sid_t sid;

            // Domains: single domain named TESTDOM
            lsarpc.LsarRefDomainList domains = new lsarpc.LsarRefDomainList();
            domains.count = 1;
            domains.max_count = 1;
            domains.domains = new lsarpc.LsarTrustInformation[1];
            domains.domains[0] = new lsarpc.LsarTrustInformation();
            domains.domains[0].name = new UnicodeString("TESTDOM", false);

        synchronized (this.domainsLock) {
            final Map<String, Map<String, CacheEntry<DfsReferralDataInternal>>> domains = getTrustedDomains(tf);
            if (domains == null) {
                return false;
            }
            domain = domain.toLowerCase(Locale.ROOT);
            return domains.get(domain) != null;
        }
    }

    }

    @ParameterizedTest
    @MethodSource("domains")
    @DisplayName("getUserDomain handles null and empty")
    void getUserDomain_edges(String domain) {
        TestCredentials creds = new TestCredentials(domain, false, false, new Subject(), false);
        assertEquals(domain, creds.getUserDomain());
    }

    static Stream<String> domains() {
        return Stream.of(null, "", "SALES");
    }

* **TCP doesn't know about "domains"**. Only about IP addresses.
    * The information about the **specific domain** requested goes in the **HTTP data**.
* The **HTTPS certificates** "certify" a **certain domain**, but the protocol and encryption happen at the TCP level, **before knowing** which domain is being dealt with.

        public LsarTrustInformation[] domains;
        /** Maximum count of domains. */
        public int max_count;

        @Override
        public void encode(NdrBuffer _dst) throws NdrException {
            _dst.align(4);
            _dst.enc_ndr_long(count);
            _dst.enc_ndr_referent(domains, 1);
            _dst.enc_ndr_long(max_count);

            if (domains != null) {