diff --git a/CHANGELOG.md b/CHANGELOG.md
index ccdba0a54..9a4f5f90a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -455,7 +455,7 @@ Deployment steps:
    - account-pages: updated to latest app (#175)
 
 ## Other updates
-- Standardise docs to use example.com everywhere (#161, #172)
+- Standardise docs to use example.com everywhere (#161, #172). (Note, 5 July 2022, example.com replaced with default.domain globally in both wire-server and wire-server-deploy, this instance excluded as it's historical)
 - Cleaned up and moved docs around to wire-docs (#157)
 
 ## Breaking changes / known issues when upgrading
diff --git a/ansible/README.md b/ansible/README.md
index 916ebd3d6..c6419b2f2 100644
--- a/ansible/README.md
+++ b/ansible/README.md
@@ -84,7 +84,7 @@ like this:
 ```yaml
 sft_servers_blue:
   vars:
-    sft_artifact_file_url: "https://example.com/path/to/sftd_42.tar.gz"
+    sft_artifact_file_url: "https://default.domain/path/to/sftd_42.tar.gz"
     sft_artifact_checksum: somechecksum_42
     srv_announcer_active: true
 ```
@@ -101,7 +101,7 @@ For `sft_servers_green`, `srv_announcer_active` must be `false`.
    ```yaml
    sft_servers_green:
    vars:
-     sft_artifact_file_url: "https://example.com/path/to/sftd_44.tar.gz"
+     sft_artifact_file_url: "https://default.domain/path/to/sftd_44.tar.gz"
      sft_artifact_checksum: somechecksum_44
      srv_announcer_active: true
    ```
@@ -122,7 +122,7 @@ For `sft_servers_green`, `srv_announcer_active` must be `false`.
    ```yaml
    sft_servers_blue:
    vars:
-     sft_artifact_file_url: "https://example.com/path/to/sftd_42.tar.gz"
+     sft_artifact_file_url: "https://default.domain/path/to/sftd_42.tar.gz"
      sft_artifact_checksum: somechecksum_42
      srv_announcer_active: false
    ```
diff --git a/ansible/inventory/demo/hosts.example.ini b/ansible/inventory/demo/hosts.example.ini
index f4402b49d..34dede15a 100644
--- a/ansible/inventory/demo/hosts.example.ini
+++ b/ansible/inventory/demo/hosts.example.ini
@@ -45,6 +45,6 @@ kubeconfig_localhost = True
 
 [minio:vars]
 prefix = "example-"
-domain = "example.com"
-deeplink_title = "example.com environment"
+domain = "default.domain"
+deeplink_title = "default.domain environment"
 
diff --git a/ansible/inventory/offline/99-static b/ansible/inventory/offline/99-static
index 4a8ba6cb0..e50c0a6a9 100644
--- a/ansible/inventory/offline/99-static
+++ b/ansible/inventory/offline/99-static
@@ -74,8 +74,8 @@
 
 ### No longer used. generated by the nginz section of values/wire-server/values.yaml instead.
 #prefix = "example-"
-#domain = "example.com"
-#deeplink_title = "example.com environment"
+#domain = "default.domain"
+#deeplink_title = "default.domain environment"
 
 [restund:vars]
 # Uncomment if your public IP is not on the default gateway
diff --git a/ansible/inventory/prod/hosts.example.ini b/ansible/inventory/prod/hosts.example.ini
index a5245bec6..18032d6d1 100644
--- a/ansible/inventory/prod/hosts.example.ini
+++ b/ansible/inventory/prod/hosts.example.ini
@@ -62,8 +62,8 @@ minio03
 minio_access_key = "REPLACE_THIS_WITH_THE_DESIRED_ACCESS_KEY"
 minio_secret_key = "REPLACE_THIS_WITH_THE_DESIRED_SECRET_KEY"
 prefix = "example-"
-domain = "example.com"
-deeplink_title = "example.com environment"
+domain = "default.domain"
+deeplink_title = "default.domain environment"
 
 [restund]
 restund01
@@ -118,7 +118,7 @@ ansible_python_interpreter = /usr/bin/python3
 # ansible_become_pass = ...
 
 ## if the servers need a proxy to access the Internet, configure it here:
-# proxy_env = "{'http_proxy': 'http://proxy.example.com:8080', 'https_proxy': 'http://proxy.example.com:8080'}"
+# proxy_env = "{'http_proxy': 'http://proxy.default.domain:8080', 'https_proxy': 'http://proxy.default.domain:8080'}"
 
 ### CASSANDRA section ###
 
diff --git a/ansible/kube-minio-static-files.yml b/ansible/kube-minio-static-files.yml
index c7604c774..da4d97adc 100644
--- a/ansible/kube-minio-static-files.yml
+++ b/ansible/kube-minio-static-files.yml
@@ -50,5 +50,5 @@
       # FUTUREWORK: parse them from a configuration file shared with helm
       # (as the domain needs to be known in helm override values.yaml)
       prefix: "{{ minio_deeplink_prefix | default('example-') }}"
-      domain: "{{ minio_deeplink_domain | default('example.com') }}"
-      deeplink_title: "{{ minio_deeplink_domain | default('example.com environment') }}"
+      domain: "{{ minio_deeplink_domain | default('default.domain') }}"
+      deeplink_title: "{{ minio_deeplink_domain | default('default.domain environment') }}"
diff --git a/ansible/minio.yml b/ansible/minio.yml
index b48f72aef..99446de6f 100644
--- a/ansible/minio.yml
+++ b/ansible/minio.yml
@@ -80,5 +80,5 @@
       # FUTUREWORK: parse them from a configuration file shared with helm
       # (as the domain needs to be known in helm override values.yaml)
       prefix: "{{ minio_deeplink_prefix | default('example-') }}"
-      domain: "{{ minio_deeplink_domain | default('example.com') }}"
-      deeplink_title: "{{ minio_deeplink_domain | default('example.com environment') }}"
+      domain: "{{ minio_deeplink_domain | default('default.domain') }}"
+      deeplink_title: "{{ minio_deeplink_domain | default('default.domain environment') }}"
diff --git a/ansible/roles/minio-static-files/defaults/main.yml b/ansible/roles/minio-static-files/defaults/main.yml
index d549d1653..cde2c2576 100644
--- a/ansible/roles/minio-static-files/defaults/main.yml
+++ b/ansible/roles/minio-static-files/defaults/main.yml
@@ -3,7 +3,7 @@
 # This role requires the following variables to be set:
 #
 #prefix: example-
-#domain: example.com
+#domain: default.domain
 #deeplink_title: Example Environment
 
 assetsURL: "https://{{ prefix }}assets.{{ domain }}"
diff --git a/examples/team-provisioning-qr-codes/README.md b/examples/team-provisioning-qr-codes/README.md
index 4829c046a..175510ebb 100644
--- a/examples/team-provisioning-qr-codes/README.md
+++ b/examples/team-provisioning-qr-codes/README.md
@@ -58,7 +58,7 @@ The script reads configuration from a series of environment variables:
 - `DEEPLINK_URL`: the URL for the private Wire server's deeplink. See [this
   page](https://docs.wire.com/how-to/associate/deeplink.html) for further
   information on using deeplinks with private Wire instances. Example:
-  `https://assets.wire.example.com/public/deeplink.html`.
+  `https://assets.wire.default.domain/public/deeplink.html`.
 
 - `INSTRUCTIONS`: path to a file containing administrator-provided setup
   instructions to be included in the generated PDF. The contents of this file
@@ -82,19 +82,19 @@ An example invocation of the script could look like this:
 
 ``` sh
     $ cat > instructions.txt <<EOF
-    These are instructions for onboarding into example.com's private Wire
+    These are instructions for onboarding into default.domain's private Wire
     server. Please scan the invite QR code on your mobile device, and create an
     account using the email address listed below. Then, please install the Wire
     application for your mobile device, and then scan the deeplink QR code and
     open the link on that page in order to configure your client to work with
-    example.com's Wire server.
+    default.domain's Wire server.
     EOF
     $
-    $ export TEAM_ADMIN_EMAIL="someone@example.com"
+    $ export TEAM_ADMIN_EMAIL="someone@default.domain"
     $ export TEAM_ADMIN_PASSWORD="password"
     $ export TEAM_ID="9cabf984-7a35-4cd5-9891-850c64f9195a"
-    $ export NGINZ_HOST="nginz-https.wire.example.com"
-    $ export DEEPLINK_URL="https://assets.wire.example.com/public/deeplink.html"
+    $ export NGINZ_HOST="nginz-https.wire.default.domain"
+    $ export DEEPLINK_URL="https://assets.wire.default.domain/public/deeplink.html"
     $ export INSTRUCTIONS=./instructions.txt
     $
     $ ./generate-user-pdf.sh john.doe@nonexistent-domain.example
diff --git a/examples/team-provisioning-qr-codes/generate-user-pdf.sh b/examples/team-provisioning-qr-codes/generate-user-pdf.sh
index 2c461aacf..5f806712d 100755
--- a/examples/team-provisioning-qr-codes/generate-user-pdf.sh
+++ b/examples/team-provisioning-qr-codes/generate-user-pdf.sh
@@ -3,11 +3,11 @@
 # The following environment variables must be set in order to query invitations
 # links via teams API and generate invite and deeplink QR codes:
 #
-# TEAM_ADMIN_EMAIL="someone@example.com"
+# TEAM_ADMIN_EMAIL="someone@default.domain"
 # TEAM_ADMIN_PASSWORD="password"
 # TEAM_ID="9cabf984-7a35-4cd5-9891-850c64f9195a"
-# NGINZ_HOST="nginz-https.wire.example.com"
-# DEEPLINK_URL="https://assets.wire.example.com/public/deeplink.html"
+# NGINZ_HOST="nginz-https.wire.default.domain"
+# DEEPLINK_URL="https://assets.wire.default.domain/public/deeplink.html"
 # INSTRUCTIONS=./instructions.txt
 #
 # This script is called with the email address of the user to create:
diff --git a/offline/docs.md b/offline/docs.md
index ab541abe9..ca079314c 100644
--- a/offline/docs.md
+++ b/offline/docs.md
@@ -184,7 +184,7 @@ the `wire.com/external-ip` annotation to the public IP of the node.
 
 ### Configuring MinIO
 
-In order to automatically generate deeplinks, Edit the minio variables in `[minio:vars]` (`prefix`, `domain` and `deeplink_title`) by replacing `example.com` with your own domain.
+In order to automatically generate deeplinks, Edit the minio variables in `[minio:vars]` (`prefix`, `domain` and `deeplink_title`) by replacing `default.domain` with your own domain.
 
 ## Generating secrets
 
@@ -351,10 +351,10 @@ Open up `./values/wire-server/secrets.yaml` and inspect the values. In theory
 this file should have only generated secrets, and no additional secrets have to
 be added, unless additional options have been enabled.
 
-Open up `./values/wire-server/values.yaml` and replace example.com and other domains and subdomain with your domain. You can do it with:
+Open up `./values/wire-server/values.yaml` and replace default.domain and other domains and subdomain with your domain. You can do it with:
 
 ```
-sed -i 's/example.com/<your-domain>/g' values.yaml
+sed -i 's/default.domain/<your-domain>/g' values.yaml
 ```
 
 
@@ -527,7 +527,7 @@ edit values/nginx-ingress-services/values.yaml , to tell ingress-ingress-service
 
 set your domain name with sed:
 ```
-sed -i "s/example.com/YOURDOMAINHERE/" values/nginx-ingress-services/values.yaml
+sed -i "s/default.domain/YOURDOMAINHERE/" values/nginx-ingress-services/values.yaml
 ```
 
 UNDER CONSTRUCTION:
@@ -585,7 +585,7 @@ d kubectl label node kubenode1 wire.com/role=sftd
 ```
 
 ##### A selected group of kubernetes nodes:
-If you are restricting SFT to certain nodes, use `nodeSelector` to run on specific nodes (**replacing the example.com domains with yours**):
+If you are restricting SFT to certain nodes, use `nodeSelector` to run on specific nodes (**replacing the default.domain domains with yours**):
 ```
 d helm upgrade --install sftd ./charts/sftd \
   --set 'nodeSelector.wire\.com/role=sftd' \
diff --git a/offline/ldap-scim-bridge.md b/offline/ldap-scim-bridge.md
index e438e8c11..d6f880cae 100644
--- a/offline/ldap-scim-bridge.md
+++ b/offline/ldap-scim-bridge.md
@@ -17,7 +17,7 @@ config:
   logLevel: "Debug"  # one of Trace,Debug,Info,Warn,Error,Fatal; Fatal is least noisy, Trace most.
   ldapSource:
     tls: true
-    host: "dc1.example.com"
+    host: "dc1.default.domain"
     port: 636
     dn: "CN=Read Only User,CN=users,DC=example,DC=com"
     password: "READONLYPASSWORD"
@@ -121,7 +121,7 @@ For active Directory:
 ```
 ldapSource:
   tls: true
-  host: "dc1.example.com"
+  host: "dc1.default.domain"
   port: 636
   dn: "CN=Wire RO,CN=users,DC=com,DC=example"
   password: "SECRETPASSWORDHERE"
@@ -129,7 +129,7 @@ ldapSource:
 
 ### Pick your users
 
-Select the user group you want to sync. for example, to find all of the people in the engineering department of the example.com AD domain:
+Select the user group you want to sync. for example, to find all of the people in the engineering department of the default.domain AD domain:
 
 ```
 search:
diff --git a/offline/upgrading.md b/offline/upgrading.md
index def4fdfbe..ec3fe1cc7 100644
--- a/offline/upgrading.md
+++ b/offline/upgrading.md
@@ -410,8 +410,8 @@ If you are restricting SFT to certain nodes, use `nodeSelector` to run on specif
 ```
 d helm upgrade --install sftd ./charts/sftd \
   --set 'nodeSelector.wire\.com/role=sftd' \
-  --set host=sftd.example.com \
-  --set allowOrigin=https://webapp.example.com \
+  --set host=sftd.default.domain \
+  --set allowOrigin=https://webapp.default.domain \
   --set-file tls.crt=/path/to/tls.crt \
   --set-file tls.key=/path/to/tls.key
 ```
@@ -419,8 +419,8 @@ d helm upgrade --install sftd ./charts/sftd \
 If you are not doing that, omit the `nodeSelector` argument:
 ```
 d helm upgrade --install sftd ./charts/sftd \
-  --set host=sftd.example.com \
-  --set allowOrigin=https://webapp.example.com \
+  --set host=sftd.default.domain \
+  --set allowOrigin=https://webapp.default.domain \
   --set-file tls.crt=/path/to/tls.crt \
   --set-file tls.key=/path/to/tls.key
 ```
diff --git a/terraform/README.md b/terraform/README.md
index 16aee9302..69afc9b15 100644
--- a/terraform/README.md
+++ b/terraform/README.md
@@ -39,7 +39,7 @@ Run all commands from `terraform/environment` directory.
    `$ENV_DIR/operator-ssh.dec`<sup>[1]</sup>. Example:
 
    ```bash
-   ssh-keygen -o -a 100 -t ed25519 -f "$ENV_DIR/operator-ssh.dec" -C "example@example.com"
+   ssh-keygen -o -a 100 -t ed25519 -f "$ENV_DIR/operator-ssh.dec" -C "example@default.domain"
    # see footnote 2 if you're a wire employee
    ```
 1. (optional) encrypt files if collaborating using SOPS:
@@ -50,7 +50,7 @@ Run all commands from `terraform/environment` directory.
 1. Create variables for the environment in `$ENV_DIR/terraform.tfvars`, example:
    ```tf
    environment = <env>
-   root_domain = "example.com"
+   root_domain = "default.domain"
    operator_ssh_public_keys = {
       terraform_managed = {
         "<key name>" = "<public key from step above>"
diff --git a/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/README.md b/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/README.md
index 49253026b..33ecd2063 100644
--- a/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/README.md
+++ b/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/README.md
@@ -34,7 +34,7 @@ module "brig_prekey_lock_and_event_queue_emailing" {
   environment = "staging"
 
   zone_id = "Z12345678SQWERTYU"
-  domain = "example.com"
+  domain = "default.domain"
 }
 ```
 
diff --git a/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/variables.mailing.tf b/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/variables.mailing.tf
index eebb188da..8df1a7f44 100644
--- a/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/variables.mailing.tf
+++ b/terraform/modules/aws-brig-prekey-lock-event-queue-email-sending/variables.mailing.tf
@@ -14,7 +14,7 @@ variable "zone_id" {
 }
 variable "domain" {
   type        = string
-  description = "FQDN of the email address that is used in 'From' when sending emails (example: example.com)"
+  description = "FQDN of the email address that is used in 'From' when sending emails (example: default.domain)"
   default     = null
 }
 
diff --git a/terraform/modules/aws-dns-records/README.md b/terraform/modules/aws-dns-records/README.md
index fbe3c1605..1a4c77ebf 100644
--- a/terraform/modules/aws-dns-records/README.md
+++ b/terraform/modules/aws-dns-records/README.md
@@ -13,13 +13,13 @@ AWS resources: route53
 
 #### How to use the module
 
-Assuming you already have a root zone with fqdn `example.com` in route53 setup elsewhere, example usage:
+Assuming you already have a root zone with fqdn `default.domain` in route53 setup elsewhere, example usage:
 
 ```hcl
 module "dns_records" {
   source = "github.com/wireapp/wire-server-deploy.git//terraform/modules/aws-dns-records?ref=CHANGE-ME"
 
-  zone_fqdn = "example.com"
+  zone_fqdn = "default.domain"
   domain = "staging"
   sub_domains = [
     "nginz-https",
@@ -41,16 +41,16 @@ module "dns_records" {
 
 This creates entries for the following FQDNs:
 
-* `nginz-https.staging.example.com`
-* `nginz-ssl.staging.example.com`
-* `webapp.staging.example.com`
-* `assets.staging.example.com`
-* `account.staging.example.com`
-* `teams.staging.example.com`
+* `nginz-https.staging.default.domain`
+* `nginz-ssl.staging.default.domain`
+* `webapp.staging.default.domain`
+* `assets.staging.default.domain`
+* `account.staging.default.domain`
+* `teams.staging.default.domain`
 
-It also creates a TXT SPF record for your mail server on `staging.example.com` with a value `"v=spf1 ip4:9.9.9.10 ip4:23.42.23.42 -all"`
+It also creates a TXT SPF record for your mail server on `staging.default.domain` with a value `"v=spf1 ip4:9.9.9.10 ip4:23.42.23.42 -all"`
 
-As well as an SRV record `_wire-server._tcp.staging.example.com` pointing to `0 10 443 nginz-https.staging.example.com`
+As well as an SRV record `_wire-server._tcp.staging.default.domain` pointing to `0 10 443 nginz-https.staging.default.domain`
 
 These sub-domains represent the primary set of FQDNs used in a
 [`wire-server` installation](https://docs.wire.com/how-to/install/helm-prod.html#how-to-set-up-dns-records),
diff --git a/terraform/modules/aws-dns-records/variables.tf b/terraform/modules/aws-dns-records/variables.tf
index cb2538d55..95703b7a1 100644
--- a/terraform/modules/aws-dns-records/variables.tf
+++ b/terraform/modules/aws-dns-records/variables.tf
@@ -1,6 +1,6 @@
 variable "zone_fqdn" {
   type        = string
-  description = "FQDN of the DNS zone root (required; example: example.com; will append: '.')"
+  description = "FQDN of the DNS zone root (required; example: default.domain; will append: '.')"
 }
 
 variable "domain" {
diff --git a/values/ldap-scim-bridge/values-prod.example.yaml b/values/ldap-scim-bridge/values-prod.example.yaml
index 15e6781bc..25c4b69d0 100644
--- a/values/ldap-scim-bridge/values-prod.example.yaml
+++ b/values/ldap-scim-bridge/values-prod.example.yaml
@@ -5,7 +5,7 @@ config:
   logLevel: "Debug" # one of Trace,Debug,Info,Warn,Error,Fatal; 'Fatal' is least noisy, 'Trace' is most.
   ldapSource:
     tls: true
-    host: "ldap-server.example.com"
+    host: "ldap-server.default.domain"
     port: 636
     dn: "CN=Admin,DC=example,DC=com"
     password: "secret password here"
diff --git a/values/nginx-ingress-services/demo-values.example.yaml b/values/nginx-ingress-services/demo-values.example.yaml
index 4618c6c37..b11201004 100644
--- a/values/nginx-ingress-services/demo-values.example.yaml
+++ b/values/nginx-ingress-services/demo-values.example.yaml
@@ -19,9 +19,9 @@ certManager:
 # NOTE: These values must be adjusted on a per installation basis
 config:
   dns:
-    https: nginz-https.example.com
-    ssl: nginz-ssl.example.com
-    webapp: webapp.example.com
-    fakeS3: assets.example.com
-    teamSettings: teams.example.com
-    accountPages: account.example.com
+    https: nginz-https.default.domain
+    ssl: nginz-ssl.default.domain
+    webapp: webapp.default.domain
+    fakeS3: assets.default.domain
+    teamSettings: teams.default.domain
+    accountPages: account.default.domain
diff --git a/values/nginx-ingress-services/prod-values.example.yaml b/values/nginx-ingress-services/prod-values.example.yaml
index 4390513f8..1737758d4 100644
--- a/values/nginx-ingress-services/prod-values.example.yaml
+++ b/values/nginx-ingress-services/prod-values.example.yaml
@@ -19,12 +19,12 @@ certManager:
 #                should be adjusted on a per installation basis
 config:
   dns:
-    https: nginz-https.example.com
-    ssl: nginz-ssl.example.com
-    webapp: webapp.example.com
-    fakeS3: assets.example.com
-    teamSettings: teams.example.com
-    accountPages: account.example.com
+    https: nginz-https.default.domain
+    ssl: nginz-ssl.default.domain
+    webapp: webapp.default.domain
+    fakeS3: assets.default.domain
+    teamSettings: teams.default.domain
+    accountPages: account.default.domain
 
 service:
   s3:
diff --git a/values/sftd/prod-values.example.yaml b/values/sftd/prod-values.example.yaml
index 8f6b66e10..eb8e7169f 100644
--- a/values/sftd/prod-values.example.yaml
+++ b/values/sftd/prod-values.example.yaml
@@ -1,5 +1,5 @@
-allowOrigin: https://webapp.example.com
-host: sftd.example.com
+allowOrigin: https://webapp.default.domain
+host: sftd.default.domain
 tls:
   issuerRef:
     name: letsencrypt-prod
diff --git a/values/wire-server/demo-values.example.yaml b/values/wire-server/demo-values.example.yaml
index c3967ee3d..f1759977d 100644
--- a/values/wire-server/demo-values.example.yaml
+++ b/values/wire-server/demo-values.example.yaml
@@ -35,28 +35,28 @@ brig:
       internalQueue: integration-brig-events-internal
       prekeyTable: integration-brig-prekeys
     externalUrls:
-      nginz: https://api.example.com # change this
-      teamSettings: https://teams.example.com # change this (on unset if team settings are not used)
-      teamCreatorWelcome: https://teams.example.com/login # change this
-      teamMemberWelcome: https://wire.example.com/download # change this
+      nginz: https://api.default.domain # change this
+      teamSettings: https://teams.default.domain # change this (on unset if team settings are not used)
+      teamCreatorWelcome: https://teams.default.domain/login # change this
+      teamMemberWelcome: https://wire.default.domain/download # change this
     optSettings:
-      setFederationDomain: example.com # change this
+      setFederationDomain: default.domain # change this
       # Sync the domain with the 'host' variable in the sftd chart
       # uncomment this section if conference calling is not used
       setSftStaticUrl: "https://sftd.example.om:443"
     emailSMS:
       general:
-        emailSender: email@example.com # change this
+        emailSender: email@default.domain # change this
         smsSender: "insert-sms-sender-for-twilio" # change this if SMS support is desired
     smtp:
       host: demo-smtp # change this if you want to use your own SMTP server
       port: 25        # change this
       connType: plain # change this. Possible values: plain|ssl|tls
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 proxy:
@@ -65,10 +65,10 @@ proxy:
 #    tag: some-tag (only override if you want a newer/different version than what is in the chart)
 #  config:
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 cannon:
@@ -88,14 +88,14 @@ cargohold:
       region: "eu-west-1"
       s3Bucket: dummy-bucket
       s3Endpoint: http://fake-aws-s3:9000
-      s3DownloadEndpoint: https://assets.example.com
+      s3DownloadEndpoint: https://assets.default.domain
     settings:
-      federationDomain: example.com # change this
+      federationDomain: default.domain # change this
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 galley:
@@ -107,16 +107,16 @@ galley:
       host: cassandra-ephemeral
       replicaCount: 1
     settings:
-      federationDomain: example.com # change this
+      federationDomain: default.domain # change this
       # prefix URI used when inviting users to a conversation by link
-      conversationCodeURI: https://example.com/conversation-join/ # change this to poitn to your account pages.
+      conversationCodeURI: https://default.domain/conversation-join/ # change this to poitn to your account pages.
     aws:
       region: "eu-west-1"
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 gundeck:
@@ -136,10 +136,10 @@ gundeck:
       sqsEndpoint: http://fake-aws-sqs:4568
       snsEndpoint: http://fake-aws-sns:4575
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 nginz:
@@ -153,7 +153,7 @@ nginz:
   nginx_conf:
     # using prod means mostly that some internal endpoints are not exposed
     env: prod
-    external_env_domain: example.com
+    external_env_domain: default.domain
   # For demo mode only, we don't need to keep websocket connections open on upgrade:
   drainTimeout: 10
   terminationGracePeriodSeconds: 30
@@ -164,12 +164,12 @@ webapp:
 #    tag: some-tag (only override if you want a newer/different version than what is in the chart)
   config:
     externalUrls:
-      backendRest: nginz-https.example.com
-      backendWebsocket: nginz-ssl.example.com
-      backendDomain: example.com
+      backendRest: nginz-https.default.domain
+      backendWebsocket: nginz-ssl.default.domain
+      backendDomain: default.domain
       # When 'tags.team-settings: true'
-      backendTeamSettings: teams.example.com
-      appHost: webapp.example.com
+      backendTeamSettings: teams.default.domain
+      appHost: webapp.default.domain
   # See full list of available environment variables: https://github.com/wireapp/wire-webapp/blob/dev/server/config.ts
   envVars:
     APP_NAME: "Webapp"
@@ -180,27 +180,27 @@ webapp:
     FEATURE_ENABLE_PHONE_LOGIN: "false"
     FEATURE_ENABLE_SSO: "false"
     FEATURE_SHOW_LOADING_INFORMATION: "false"
-    URL_ACCOUNT_BASE: "https://account.example.com"
+    URL_ACCOUNT_BASE: "https://account.default.domain"
     #URL_MOBILE_BASE: "https://wire-pwa-staging.zinfra.io" # TODO: is this needed?
-    URL_PRIVACY_POLICY: "https://www.example.com/terms-conditions"
-    URL_SUPPORT_BASE: "https://www.example.com/support"
-    URL_TEAMS_BASE: "https://teams.example.com"
-    URL_TEAMS_CREATE: "https://teams.example.com"
-    URL_TERMS_OF_USE_PERSONAL: "https://www.example.com/terms-conditions"
-    URL_TERMS_OF_USE_TEAMS: "https://www.example.com/terms-conditions"
-    URL_WEBSITE_BASE: "https://www.example.com"
-    CSP_EXTRA_CONNECT_SRC: "https://*.example.com, wss://*.example.com"
-    CSP_EXTRA_IMG_SRC: "https://*.example.com"
-    CSP_EXTRA_SCRIPT_SRC: "https://*.example.com"
-    CSP_EXTRA_DEFAULT_SRC: "https://*.example.com"
-    CSP_EXTRA_FONT_SRC: "https://*.example.com"
-    CSP_EXTRA_FRAME_SRC: "https://*.example.com"
-    CSP_EXTRA_MANIFEST_SRC: "https://*.example.com"
-    CSP_EXTRA_OBJECT_SRC: "https://*.example.com"
-    CSP_EXTRA_MEDIA_SRC: "https://*.example.com"
-    CSP_EXTRA_PREFETCH_SRC: "https://*.example.com"
-    CSP_EXTRA_STYLE_SRC: "https://*.example.com"
-    CSP_EXTRA_WORKER_SRC: "https://*.example.com"
+    URL_PRIVACY_POLICY: "https://www.default.domain/terms-conditions"
+    URL_SUPPORT_BASE: "https://www.default.domain/support"
+    URL_TEAMS_BASE: "https://teams.default.domain"
+    URL_TEAMS_CREATE: "https://teams.default.domain"
+    URL_TERMS_OF_USE_PERSONAL: "https://www.default.domain/terms-conditions"
+    URL_TERMS_OF_USE_TEAMS: "https://www.default.domain/terms-conditions"
+    URL_WEBSITE_BASE: "https://www.default.domain"
+    CSP_EXTRA_CONNECT_SRC: "https://*.default.domain, wss://*.default.domain"
+    CSP_EXTRA_IMG_SRC: "https://*.default.domain"
+    CSP_EXTRA_SCRIPT_SRC: "https://*.default.domain"
+    CSP_EXTRA_DEFAULT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FONT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FRAME_SRC: "https://*.default.domain"
+    CSP_EXTRA_MANIFEST_SRC: "https://*.default.domain"
+    CSP_EXTRA_OBJECT_SRC: "https://*.default.domain"
+    CSP_EXTRA_MEDIA_SRC: "https://*.default.domain"
+    CSP_EXTRA_PREFETCH_SRC: "https://*.default.domain"
+    CSP_EXTRA_STYLE_SRC: "https://*.default.domain"
+    CSP_EXTRA_WORKER_SRC: "https://*.default.domain"
 
 team-settings:
   replicaCount: 1
@@ -210,10 +210,10 @@ team-settings:
     IS_SELF_HOSTED: "true"
   config:
     externalUrls:
-      backendRest: nginz-https.example.com
-      backendWebsocket: nginz-ssl.example.com
-      backendDomain: example.com
-      appHost: teams.example.com
+      backendRest: nginz-https.default.domain
+      backendWebsocket: nginz-ssl.default.domain
+      backendDomain: default.domain
+      appHost: teams.default.domain
 
 account-pages:
   replicaCount: 1
@@ -223,6 +223,6 @@ account-pages:
     IS_SELF_HOSTED: "true"
   config:
     externalUrls:
-      backendRest: nginz-https.example.com
-      backendDomain: example.com
-      appHost: account.example.com
+      backendRest: nginz-https.default.domain
+      backendDomain: default.domain
+      appHost: account.default.domain
diff --git a/values/wire-server/prod-values.example.yaml b/values/wire-server/prod-values.example.yaml
index d9aad21d0..b78f51fdc 100644
--- a/values/wire-server/prod-values.example.yaml
+++ b/values/wire-server/prod-values.example.yaml
@@ -40,18 +40,18 @@ brig:
       internalQueue: integration-brig-events-internal
       prekeyTable: integration-brig-prekeys
     externalUrls:
-      nginz: https://nginz-https.example.com # change this
-      teamSettings: https://teams.example.com # change this (or unset if team settings are not used)
-      teamCreatorWelcome: https://teams.example.com/login # change this
-      teamMemberWelcome: https://wire.example.com/download # change this
+      nginz: https://nginz-https.default.domain # change this
+      teamSettings: https://teams.default.domain # change this (or unset if team settings are not used)
+      teamCreatorWelcome: https://teams.default.domain/login # change this
+      teamMemberWelcome: https://wire.default.domain/download # change this
     optSettings:
-      setFederationDomain: example.com # change this
+      setFederationDomain: default.domain # change this
       # Sync the domain with the 'host' variable in the sftd chart
       # Comment the next line (by adding '#' before it) if conference calling is not used
-      setSftStaticUrl: "https://sftd.example.com:443"
+      setSftStaticUrl: "https://sftd.default.domain:443"
     emailSMS:
       general:
-        emailSender: email@example.com # change this
+        emailSender: email@default.domain # change this
         smsSender: "insert-sms-sender-for-twilio" # change this if SMS support is desired
         templateBranding: # change all of these, they are used in emails
           brand: Wire
@@ -66,20 +66,20 @@ brig:
           forgot: https://wire.com/forgot/
           support: https://support.wire.com/
       user:
-        passwordResetUrl: https://account.example.com/reset/?key=${key}&code=${code}
-        activationUrl: https://account.example.com/verify/?key=${key}&code=${code}
-        smsActivationUrl: https://account.example.com/v/${code}
-        deletionUrl: https://account.example.com/d/?key=${key}&code=${code}
-        invitationUrl: https://account.example.com/i/${code}
+        passwordResetUrl: https://account.default.domain/reset/?key=${key}&code=${code}
+        activationUrl: https://account.default.domain/verify/?key=${key}&code=${code}
+        smsActivationUrl: https://account.default.domain/v/${code}
+        deletionUrl: https://account.default.domain/d/?key=${key}&code=${code}
+        invitationUrl: https://account.default.domain/i/${code}
     smtp:
       host: demo-smtp # change this if you want to use your own SMTP server
       port: 25        # change this
       connType: plain # change this. Possible values: plain|ssl|tls
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
   turnStatic:
     v1: []
@@ -98,10 +98,10 @@ proxy:
 #    tag: some-tag (only override if you want a newer/different version than what is in the chart)
 #  config:
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 cannon:
@@ -121,14 +121,14 @@ cargohold:
       region: "eu-west-1"
       s3Bucket: assets
       s3Endpoint: http://minio-external:9000
-      s3DownloadEndpoint: https://assets.example.com
+      s3DownloadEndpoint: https://assets.default.domain
     settings:
-      federationDomain: example.com # change this
+      federationDomain: default.domain # change this
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 galley:
@@ -140,8 +140,8 @@ galley:
       host: cassandra-external
     settings:
       # prefix URI used when inviting users to a conversation by link
-      conversationCodeURI: https://account.example.com/conversation-join/ # change this
-      federationDomain: example.com # change this
+      conversationCodeURI: https://account.default.domain/conversation-join/ # change this
+      federationDomain: default.domain # change this
       # see #RefConfigOptions in `/docs/reference` (https://github.com/wireapp/wire-server/)
       featureFlags:
         sso: disabled-by-default
@@ -152,10 +152,10 @@ galley:
     aws:
       region: "eu-west-1"
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 gundeck:
@@ -174,10 +174,10 @@ gundeck:
       sqsEndpoint: http://fake-aws-sqs:4568
       snsEndpoint: http://fake-aws-sns:4575
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 nginz:
@@ -191,13 +191,13 @@ nginz:
   nginx_conf:
     # using prod means mostly that some internal endpoints are not exposed
     env: prod
-    external_env_domain: example.com
+    external_env_domain: default.domain
     deeplink:
       endpoints:
-        backendURL: "https://nginz-https.example.com"
-        backendWSURL: "https://nginz-ssl.example.com"
-        teamsURL: "https://teams.example.com"
-        accountsURL: "https://account.example.com"
+        backendURL: "https://nginz-https.default.domain"
+        backendWSURL: "https://nginz-ssl.default.domain"
+        teamsURL: "https://teams.default.domain"
+        accountsURL: "https://account.default.domain"
         blackListURL: "https://clientblacklist.wire.com/prod"
         websiteURL: "https://wire.com"
       title: "My Custom Wire Backend"
@@ -218,21 +218,21 @@ spar:
     cassandra:
       host: cassandra-external
     logLevel: Debug
-    domain: example.com
-    appUri: https://nginz-https.example.com
-    ssoUri: https://nginz-https.example.com/sso
+    domain: default.domain
+    appUri: https://nginz-https.default.domain
+    ssoUri: https://nginz-https.default.domain/sso
     maxttlAuthreq: 28800
     maxttlAuthresp: 28800
     # maxScimTokens: 16 # uncomment this if you want to use SCIM provisioning
     contacts:
     - type: ContactSupport
       company: YourCompany
-      email: email:support@example.com
+      email: email:support@default.domain
 #    proxy:
-#      httpProxy: "http://proxy.example.com"
-#      httpsProxy: "https://proxy.example.com"
+#      httpProxy: "http://proxy.default.domain"
+#      httpsProxy: "https://proxy.default.domain"
 #      noProxyList:
-#        - "local.example.com"
+#        - "local.default.domain"
 #        - "10.23.0.0/16"
 
 webapp:
@@ -241,11 +241,11 @@ webapp:
 #    tag: some-tag (only override if you want a newer/different version than what is in the chart)
   config:
     externalUrls:
-      backendRest: nginz-https.example.com
-      backendWebsocket: nginz-ssl.example.com
-      backendDomain: example.com
-      backendTeamSettings: teams.example.com
-      appHost: webapp.example.com
+      backendRest: nginz-https.default.domain
+      backendWebsocket: nginz-ssl.default.domain
+      backendDomain: default.domain
+      backendTeamSettings: teams.default.domain
+      appHost: webapp.default.domain
   # See full list of available environment variables: https://github.com/wireapp/wire-webapp/blob/dev/server/config.ts
   envVars:
     APP_NAME: "Webapp"
@@ -256,27 +256,27 @@ webapp:
     FEATURE_ENABLE_PHONE_LOGIN: "false"
     FEATURE_ENABLE_SSO: "false"
     FEATURE_SHOW_LOADING_INFORMATION: "false"
-    URL_ACCOUNT_BASE: "https://account.example.com"
+    URL_ACCOUNT_BASE: "https://account.default.domain"
     #URL_MOBILE_BASE: "https://wire-pwa-staging.zinfra.io" # TODO: is this needed?
-    URL_PRIVACY_POLICY: "https://www.example.com/terms-conditions"
-    URL_SUPPORT_BASE: "https://www.example.com/support"
-    URL_TEAMS_BASE: "https://teams.example.com"
-    URL_TEAMS_CREATE: "https://teams.example.com"
-    URL_TERMS_OF_USE_PERSONAL: "https://www.example.com/terms-conditions"
-    URL_TERMS_OF_USE_TEAMS: "https://www.example.com/terms-conditions"
-    URL_WEBSITE_BASE: "https://www.example.com"
-    CSP_EXTRA_CONNECT_SRC: "https://*.example.com, wss://*.example.com"
-    CSP_EXTRA_IMG_SRC: "https://*.example.com"
-    CSP_EXTRA_SCRIPT_SRC: "https://*.example.com"
-    CSP_EXTRA_DEFAULT_SRC: "https://*.example.com"
-    CSP_EXTRA_FONT_SRC: "https://*.example.com"
-    CSP_EXTRA_FRAME_SRC: "https://*.example.com"
-    CSP_EXTRA_MANIFEST_SRC: "https://*.example.com"
-    CSP_EXTRA_OBJECT_SRC: "https://*.example.com"
-    CSP_EXTRA_MEDIA_SRC: "https://*.example.com"
-    CSP_EXTRA_PREFETCH_SRC: "https://*.example.com"
-    CSP_EXTRA_STYLE_SRC: "https://*.example.com"
-    CSP_EXTRA_WORKER_SRC: "https://*.example.com"
+    URL_PRIVACY_POLICY: "https://www.default.domain/terms-conditions"
+    URL_SUPPORT_BASE: "https://www.default.domain/support"
+    URL_TEAMS_BASE: "https://teams.default.domain"
+    URL_TEAMS_CREATE: "https://teams.default.domain"
+    URL_TERMS_OF_USE_PERSONAL: "https://www.default.domain/terms-conditions"
+    URL_TERMS_OF_USE_TEAMS: "https://www.default.domain/terms-conditions"
+    URL_WEBSITE_BASE: "https://www.default.domain"
+    CSP_EXTRA_CONNECT_SRC: "https://*.default.domain, wss://*.default.domain"
+    CSP_EXTRA_IMG_SRC: "https://*.default.domain"
+    CSP_EXTRA_SCRIPT_SRC: "https://*.default.domain"
+    CSP_EXTRA_DEFAULT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FONT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FRAME_SRC: "https://*.default.domain"
+    CSP_EXTRA_MANIFEST_SRC: "https://*.default.domain"
+    CSP_EXTRA_OBJECT_SRC: "https://*.default.domain"
+    CSP_EXTRA_MEDIA_SRC: "https://*.default.domain"
+    CSP_EXTRA_PREFETCH_SRC: "https://*.default.domain"
+    CSP_EXTRA_STYLE_SRC: "https://*.default.domain"
+    CSP_EXTRA_WORKER_SRC: "https://*.default.domain"
 
 # NOTE: Only relevant if you want team-settings
 team-settings:
@@ -285,10 +285,10 @@ team-settings:
 #    tag: some-tag (only override if you want a newer/different version than what is in the chart)
   config:
     externalUrls:
-      backendRest: nginz-https.example.com
-      backendWebsocket: nginz-ssl.example.com
-      backendDomain: example.com
-      appHost: teams.example.com
+      backendRest: nginz-https.default.domain
+      backendWebsocket: nginz-ssl.default.domain
+      backendDomain: default.domain
+      appHost: teams.default.domain
   # See full list of available environment variables: https://github.com/wireapp/wire-team-settings/blob/dev/server/config.ts
   envVars:
     APP_NAME: "Team Settings"
@@ -298,22 +298,22 @@ team-settings:
     FEATURE_ENABLE_NEW_TEAM: "true"
     # NOTE: Uncomment this for legalhold support in the Team-settings UI
     # FEATURE_ENABLE_LEGAL_HOLD: "true"
-    URL_ACCOUNT_BASE: "https://account.example.com"
-    URL_WEBAPP_BASE: "https://webapp.example.com"
-    URL_WEBSITE_BASE: "https://www.example.com"
-    WEBSITE_LABEL: "www.example.com"
-    CSP_EXTRA_CONNECT_SRC: "https://*.example.com, wss://*.example.com"
-    CSP_EXTRA_IMG_SRC: "https://*.example.com"
-    CSP_EXTRA_SCRIPT_SRC: "https://*.example.com"
-    CSP_EXTRA_DEFAULT_SRC: "https://*.example.com"
-    CSP_EXTRA_FONT_SRC: "https://*.example.com"
-    CSP_EXTRA_FRAME_SRC: "https://*.example.com"
-    CSP_EXTRA_MANIFEST_SRC: "https://*.example.com"
-    CSP_EXTRA_OBJECT_SRC: "https://*.example.com"
-    CSP_EXTRA_MEDIA_SRC: "https://*.example.com"
-    CSP_EXTRA_PREFETCH_SRC: "https://*.example.com"
-    CSP_EXTRA_STYLE_SRC: "https://*.example.com"
-    CSP_EXTRA_WORKER_SRC: "https://*.example.com"
+    URL_ACCOUNT_BASE: "https://account.default.domain"
+    URL_WEBAPP_BASE: "https://webapp.default.domain"
+    URL_WEBSITE_BASE: "https://www.default.domain"
+    WEBSITE_LABEL: "www.default.domain"
+    CSP_EXTRA_CONNECT_SRC: "https://*.default.domain, wss://*.default.domain"
+    CSP_EXTRA_IMG_SRC: "https://*.default.domain"
+    CSP_EXTRA_SCRIPT_SRC: "https://*.default.domain"
+    CSP_EXTRA_DEFAULT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FONT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FRAME_SRC: "https://*.default.domain"
+    CSP_EXTRA_MANIFEST_SRC: "https://*.default.domain"
+    CSP_EXTRA_OBJECT_SRC: "https://*.default.domain"
+    CSP_EXTRA_MEDIA_SRC: "https://*.default.domain"
+    CSP_EXTRA_PREFETCH_SRC: "https://*.default.domain"
+    CSP_EXTRA_STYLE_SRC: "https://*.default.domain"
+    CSP_EXTRA_WORKER_SRC: "https://*.default.domain"
     IS_SELF_HOSTED: "true"
 
 # NOTE: Only relevant if you want account-pages
@@ -323,37 +323,37 @@ account-pages:
 #    tag: some-tag (only override if you want a newer/different version than what is in the chart)
   config:
     externalUrls:
-      backendRest: nginz-https.example.com
-      backendDomain: example.com
-      appHost: account.example.com
+      backendRest: nginz-https.default.domain
+      backendDomain: default.domain
+      appHost: account.default.domain
   # See full list of available environment variables: https://github.com/wireapp/wire-account/blob/dev/server/config.ts
   envVars:
     APP_NAME: "Wire Account Management"
     COMPANY_NAME: "YourCompany"
     FEATURE_ENFORCE_HTTPS: "true"
     FEATURE_ENABLE_DEBUG: "false"
-    URL_SUPPORT_BASE: "https://www.example.com/support"
-    URL_TEAMS_BASE: "https://teams.example.com"
-    URL_WEBAPP_BASE: "https://webapp.example.com"
-    URL_WEBSITE_BASE: "https://www.example.com"
-    CSP_EXTRA_CONNECT_SRC: "https://*.example.com, wss://*.example.com"
-    CSP_EXTRA_IMG_SRC: "https://*.example.com"
-    CSP_EXTRA_SCRIPT_SRC: "https://*.example.com"
-    CSP_EXTRA_DEFAULT_SRC: "https://*.example.com"
-    CSP_EXTRA_FONT_SRC: "https://*.example.com"
-    CSP_EXTRA_FRAME_SRC: "https://*.example.com"
-    CSP_EXTRA_MANIFEST_SRC: "https://*.example.com"
-    CSP_EXTRA_OBJECT_SRC: "https://*.example.com"
-    CSP_EXTRA_MEDIA_SRC: "https://*.example.com"
-    CSP_EXTRA_PREFETCH_SRC: "https://*.example.com"
-    CSP_EXTRA_STYLE_SRC: "https://*.example.com"
-    CSP_EXTRA_WORKER_SRC: "https://*.example.com"
+    URL_SUPPORT_BASE: "https://www.default.domain/support"
+    URL_TEAMS_BASE: "https://teams.default.domain"
+    URL_WEBAPP_BASE: "https://webapp.default.domain"
+    URL_WEBSITE_BASE: "https://www.default.domain"
+    CSP_EXTRA_CONNECT_SRC: "https://*.default.domain, wss://*.default.domain"
+    CSP_EXTRA_IMG_SRC: "https://*.default.domain"
+    CSP_EXTRA_SCRIPT_SRC: "https://*.default.domain"
+    CSP_EXTRA_DEFAULT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FONT_SRC: "https://*.default.domain"
+    CSP_EXTRA_FRAME_SRC: "https://*.default.domain"
+    CSP_EXTRA_MANIFEST_SRC: "https://*.default.domain"
+    CSP_EXTRA_OBJECT_SRC: "https://*.default.domain"
+    CSP_EXTRA_MEDIA_SRC: "https://*.default.domain"
+    CSP_EXTRA_PREFETCH_SRC: "https://*.default.domain"
+    CSP_EXTRA_STYLE_SRC: "https://*.default.domain"
+    CSP_EXTRA_WORKER_SRC: "https://*.default.domain"
     IS_SELF_HOSTED: "true"
 
 # Only needed when legalhold is enabled
 legalhold:
-  host: "legalhold.example.com"
-  wireApiHost: "https://nginz-https.example.com"
+  host: "legalhold.default.domain"
+  wireApiHost: "https://nginz-https.default.domain"
 
 # Only needed when federation is enabled
 federator: