diff --git a/config/core/configmaps/domain.yaml b/config/core/configmaps/domain.yaml
index df09c58f0052..2d4ced37201c 100644
--- a/config/core/configmaps/domain.yaml
+++ b/config/core/configmaps/domain.yaml
@@ -22,7 +22,7 @@ metadata:
     app.kubernetes.io/component: controller
     app.kubernetes.io/version: devel
   annotations:
-    knative.dev/example-checksum: "81552d0b"
+    knative.dev/example-checksum: "26c09de5"
 data:
   _example: |
     ################################
@@ -41,16 +41,6 @@ data:
     # to actually change the configuration.
 
     # Default value for domain.
-    # Although it will match all routes, it is the least-specific rule so it
-    # will only be used if no other domain matches.
-    example.com: |
-
-    # These are example settings of domain.
-    # example.org will be used for routes having app=nonprofit.
-    example.org: |
-      selector:
-        app: nonprofit
-
     # Routes having the cluster domain suffix (by default 'svc.cluster.local')
     # will not be exposed through Ingress. You can define your own label
     # selector to assign that domain suffix to your Route here, or you can set
@@ -61,3 +51,13 @@ data:
     svc.cluster.local: |
       selector:
         app: secret
+
+    # These are example settings of domain.
+    # example.com will be used for all routes, but it is the least-specific rule so it
+    # will only be used if no other domain matches.
+    example.com: |
+
+    # example.org will be used for routes having app=nonprofit.
+    example.org: |
+      selector:
+        app: nonprofit
diff --git a/pkg/reconciler/nscert/nscert_test.go b/pkg/reconciler/nscert/nscert_test.go
index 378969d3fdad..f58a12540b01 100644
--- a/pkg/reconciler/nscert/nscert_test.go
+++ b/pkg/reconciler/nscert/nscert_test.go
@@ -110,7 +110,7 @@ func newTestSetup(t *testing.T, configs ...*corev1.ConfigMap) (
 			Namespace: system.Namespace(),
 		},
 		Data: map[string]string{
-			"example.com": "",
+			"svc.cluster.local": "",
 		},
 	}}
 	cms = append(cms, configs...)
@@ -161,7 +161,7 @@ func TestNewController(t *testing.T) {
 				Namespace: system.Namespace(),
 			},
 			Data: map[string]string{
-				"example.com": "",
+				"svc.cluster.local": "",
 			}},
 	)
 
@@ -430,7 +430,7 @@ func TestChangeDefaultDomain(t *testing.T) {
 
 	// The certificate should be created with the default domain.
 	cert := <-certEvents
-	if got, want := cert.Spec.DNSNames[0], "*.testns.example.com"; got != want {
+	if got, want := cert.Spec.DNSNames[0], "*.testns.svc.cluster.local"; got != want {
 		t.Errorf("DNSName[0] = %s, want %s", got, want)
 	}
 
@@ -483,8 +483,8 @@ func TestDomainConfigDomain(t *testing.T) {
 			"autoTLS":                          "Enabled",
 			"namespace-wildcard-cert-selector": "{}",
 		},
-		wantCertName: "testns.example.com",
-		wantDNSName:  "*.testns.example.com",
+		wantCertName: "testns.svc.cluster.local",
+		wantDNSName:  "*.testns.svc.cluster.local",
 	}, {
 		name: "default domain",
 		domainCfg: map[string]string{
diff --git a/pkg/reconciler/route/config/domain.go b/pkg/reconciler/route/config/domain.go
index 80070a10ce33..ce42abf6de02 100644
--- a/pkg/reconciler/route/config/domain.go
+++ b/pkg/reconciler/route/config/domain.go
@@ -33,7 +33,7 @@ const (
 	DomainConfigName = "config-domain"
 	// DefaultDomain holds the domain that Route's live under by default
 	// when no label selector-based options apply.
-	DefaultDomain = "example.com"
+	DefaultDomain = "svc.cluster.local"
 )
 
 // LabelSelector represents map of {key,value} pairs. A single {key,value} in the
diff --git a/test/config/ytt/core/overlay-config-domain.yaml b/test/config/ytt/core/overlay-config-domain.yaml
new file mode 100644
index 000000000000..481fd143df0a
--- /dev/null
+++ b/test/config/ytt/core/overlay-config-domain.yaml
@@ -0,0 +1,8 @@
+#@ load("@ytt:overlay", "overlay")
+#@ load("helpers.lib.yaml", "system_configmap")
+
+#@overlay/match by=system_configmap("config-domain"), expects=1
+---
+#@overlay/match-child-defaults missing_ok=True
+data:
+  example.com: |