diff --git a/crates/claims/crates/data-integrity/core/src/options.rs b/crates/claims/crates/data-integrity/core/src/options.rs
index 0ed4e670e..14a8fe93b 100644
--- a/crates/claims/crates/data-integrity/core/src/options.rs
+++ b/crates/claims/crates/data-integrity/core/src/options.rs
@@ -40,8 +40,8 @@ pub struct ProofOptions<M, T> {
     /// Example domain values include: `domain.example`` (DNS domain),
     /// `https://domain.example:8443` (Web origin), `mycorp-intranet` (bespoke
     /// text string), and `b31d37d4-dd59-47d3-9dd8-c973da43b63a` (UUID).
-    #[serde(default, skip_serializing_if = "Vec::is_empty", rename = "domain")]
-    pub domains: Vec<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none", rename = "domain")]
+    pub domains: Option<String>,
 
     /// Used to mitigate replay attacks.
     ///
@@ -78,7 +78,7 @@ impl<M, T: Default> Default for ProofOptions<M, T> {
             verification_method: None,
             proof_purpose: ProofPurpose::default(),
             expires: None,
-            domains: Vec::new(),
+            domains: None,
             challenge: None,
             nonce: None,
             options: Default::default(),
@@ -100,7 +100,7 @@ impl<M, T> ProofOptions<M, T> {
             verification_method: Some(verification_method),
             proof_purpose,
             expires: None,
-            domains: Vec::new(),
+            domains: None,
             challenge: None,
             nonce: None,
             options,
@@ -115,7 +115,7 @@ impl<M, T> ProofOptions<M, T> {
             verification_method: Some(verification_method),
             proof_purpose: ProofPurpose::default(),
             expires: None,
-            domains: Vec::new(),
+            domains: None,
             challenge: None,
             nonce: None,
             options,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs b/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs
index 0e6fe7146..ae9e2d7e2 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/configuration/mod.rs
@@ -57,8 +57,8 @@ pub struct ProofConfiguration<S: CryptographicSuite> {
     /// Example domain values include: `domain.example`` (DNS domain),
     /// `https://domain.example:8443` (Web origin), `mycorp-intranet` (bespoke
     /// text string), and `b31d37d4-dd59-47d3-9dd8-c973da43b63a` (UUID).
-    #[serde(skip_serializing_if = "Vec::is_empty", rename = "domain")]
-    pub domains: Vec<String>,
+    #[serde(skip_serializing_if = "Option::is_none", rename = "domain")]
+    pub domains: Option<String>,
 
     /// Used to mitigate replay attacks.
     ///
@@ -102,7 +102,7 @@ impl<S: CryptographicSuite> ProofConfiguration<S> {
             verification_method,
             proof_purpose,
             expires: None,
-            domains: Vec::new(),
+            domains: None,
             challenge: None,
             nonce: None,
             options,
@@ -122,7 +122,7 @@ impl<S: CryptographicSuite> ProofConfiguration<S> {
             verification_method,
             proof_purpose: ProofPurpose::default(),
             expires: None,
-            domains: Vec::new(),
+            domains: None,
             challenge: None,
             nonce: None,
             options,
@@ -221,7 +221,7 @@ impl<S: CryptographicSuite> ProofConfiguration<S> {
             verification_method: self.verification_method.borrowed(),
             proof_purpose: self.proof_purpose,
             expires: self.expires,
-            domains: &self.domains,
+            domains: self.domains.as_deref(),
             challenge: self.challenge.as_deref(),
             nonce: self.nonce.as_deref(),
             options: &self.options,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs b/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs
index 30668a2a6..6d2e6223a 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/configuration/reference.rs
@@ -30,8 +30,8 @@ pub struct ProofConfigurationRef<'a, S: CryptographicSuite> {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub expires: Option<xsd_types::DateTimeStamp>,
 
-    #[serde(skip_serializing_if = "<[String]>::is_empty")]
-    pub domains: &'a [String],
+    #[serde(skip_serializing_if = "Option::is_none", rename = "domain")]
+    pub domains: Option<&'a str>,
 
     #[serde(skip_serializing_if = "Option::is_none")]
     pub challenge: Option<&'a str>,
@@ -59,7 +59,7 @@ impl<'a, S: CryptographicSuite> ProofConfigurationRef<'a, S> {
             verification_method: S::clone_verification_method_ref_ref(self.verification_method),
             proof_purpose: self.proof_purpose,
             expires: self.expires,
-            domains: self.domains.to_owned(),
+            domains: self.domains.map(ToOwned::to_owned),
             challenge: self.challenge.map(ToOwned::to_owned),
             nonce: self.nonce.map(ToOwned::to_owned),
             options: S::clone_proof_options(self.options),
@@ -151,8 +151,8 @@ pub struct ProofConfigurationRefWithoutOptions<'a, S: CryptographicSuite> {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub expires: Option<xsd_types::DateTimeStamp>,
 
-    #[serde(skip_serializing_if = "<[String]>::is_empty")]
-    pub domains: &'a [String],
+    #[serde(skip_serializing_if = "Option::is_none", rename = "domain")]
+    pub domains: Option<&'a str>,
 
     #[serde(skip_serializing_if = "Option::is_none")]
     pub challenge: Option<&'a str>,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/mod.rs b/crates/claims/crates/data-integrity/core/src/proof/mod.rs
index 16c138d9c..44eba2f97 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/mod.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/mod.rs
@@ -81,8 +81,8 @@ pub struct Proof<S: CryptographicSuite> {
     /// Example domain values include: `domain.example`` (DNS domain),
     /// `https://domain.example:8443` (Web origin), `mycorp-intranet` (bespoke
     /// text string), and `b31d37d4-dd59-47d3-9dd8-c973da43b63a` (UUID).
-    #[serde(skip_serializing_if = "Vec::is_empty", rename = "domain")]
-    pub domains: Vec<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none", rename = "domain")]
+    pub domains: Option<String>,
 
     /// Used to mitigate replay attacks.
     ///
@@ -132,7 +132,7 @@ impl<T: CryptographicSuite> Proof<T> {
             verification_method,
             proof_purpose,
             expires: None,
-            domains: Vec::new(),
+            domains: None,
             challenge: None,
             nonce: None,
             options,
@@ -149,7 +149,7 @@ impl<T: CryptographicSuite> Proof<T> {
             verification_method: self.verification_method.borrowed(),
             proof_purpose: self.proof_purpose,
             expires: self.expires,
-            domains: &self.domains,
+            domains: self.domains.as_deref(),
             challenge: self.challenge.as_deref(),
             nonce: self.nonce.as_deref(),
             options: &self.options,
@@ -177,7 +177,7 @@ impl<T: CryptographicSuite> Proof<T> {
             verification_method: self.verification_method.borrowed(),
             proof_purpose: self.proof_purpose,
             expires: self.expires,
-            domains: &self.domains,
+            domains: self.domains.as_deref(),
             challenge: self.challenge.as_deref(),
             nonce: self.nonce.as_deref(),
             options: &self.options,
diff --git a/crates/claims/crates/data-integrity/core/src/proof/reference.rs b/crates/claims/crates/data-integrity/core/src/proof/reference.rs
index f5278d4bc..bfbc4ef59 100644
--- a/crates/claims/crates/data-integrity/core/src/proof/reference.rs
+++ b/crates/claims/crates/data-integrity/core/src/proof/reference.rs
@@ -17,7 +17,7 @@ pub struct ProofRef<'a, S: CryptographicSuite> {
 
     pub expires: Option<xsd_types::DateTimeStamp>,
 
-    pub domains: &'a [String],
+    pub domains: Option<&'a str>,
 
     pub challenge: Option<&'a str>,
 
diff --git a/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs b/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs
index e00cd9a33..32490cccd 100644
--- a/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs
+++ b/crates/claims/crates/data-integrity/suites/src/suites/w3c/ecdsa_sd_2023/derive.rs
@@ -76,7 +76,7 @@ where
         verification_method: base_proof.verification_method.cloned(),
         proof_purpose: base_proof.proof_purpose,
         expires: base_proof.expires,
-        domains: base_proof.domains.to_vec(),
+        domains: base_proof.domains.map(ToOwned::to_owned),
         challenge: base_proof.challenge.map(ToOwned::to_owned),
         nonce: base_proof.nonce.map(ToOwned::to_owned),
         options: *base_proof.options,