diff --git a/docs/flows.md b/docs/flows.md
index 4b8a0fdf4..d5c383a24 100644
--- a/docs/flows.md
+++ b/docs/flows.md
@@ -752,6 +752,7 @@ application. Updates cannot change the domain name that is being applied for.
     *   Application status prohibits this domain update.
 *   2306
     *   Cannot add and remove the same value.
+    *   Application referenced does not match specified domain name.
     *   More than one contact for a given role is not allowed.
     *   Missing type attribute for contact.
     *   The secDNS:all element must have value 'true' if present.
diff --git a/java/google/registry/flows/domain/DomainApplicationUpdateFlow.java b/java/google/registry/flows/domain/DomainApplicationUpdateFlow.java
index 662eee803..1ca4dd5d4 100644
--- a/java/google/registry/flows/domain/DomainApplicationUpdateFlow.java
+++ b/java/google/registry/flows/domain/DomainApplicationUpdateFlow.java
@@ -30,6 +30,7 @@ import static google.registry.flows.domain.DomainFlowUtils.validateNameserversCo
 import static google.registry.flows.domain.DomainFlowUtils.validateNoDuplicateContacts;
 import static google.registry.flows.domain.DomainFlowUtils.validateRegistrantAllowedOnTld;
 import static google.registry.flows.domain.DomainFlowUtils.validateRequiredContactsPresent;
+import static google.registry.flows.domain.DomainFlowUtils.verifyApplicationDomainMatchesTargetId;
 import static google.registry.flows.domain.DomainFlowUtils.verifyClientUpdateNotProhibited;
 import static google.registry.flows.domain.DomainFlowUtils.verifyNotInPendingDelete;
 import static google.registry.flows.domain.DomainFlowUtils.verifyStatusChangesAreClientSettable;
@@ -79,6 +80,7 @@ import javax.inject.Inject;
  * @error {@link google.registry.flows.exceptions.ResourceHasClientUpdateProhibitedException}
  * @error {@link google.registry.flows.exceptions.ResourceStatusProhibitsOperationException}
  * @error {@link google.registry.flows.exceptions.StatusNotClientSettableException}
+ * @error {@link DomainFlowUtils.ApplicationDomainNameMismatchException}
  * @error {@link DomainFlowUtils.DuplicateContactForRoleException}
  * @error {@link DomainFlowUtils.EmptySecDnsUpdateException}
  * @error {@link DomainFlowUtils.LinkedResourcesDoNotExistException}
@@ -133,6 +135,7 @@ public class DomainApplicationUpdateFlow extends LoggedInFlow implements Transac
     Update command = cloneAndLinkReferences((Update) resourceCommand, now);
     DomainApplication existingApplication = verifyExistence(
         DomainApplication.class, applicationId, loadDomainApplication(applicationId, now));
+    verifyApplicationDomainMatchesTargetId(existingApplication, targetId);
     verifyNoDisallowedStatuses(existingApplication, UPDATE_DISALLOWED_STATUSES);
     verifyOptionalAuthInfoForResource(authInfo, existingApplication);
     verifyUpdateAllowed(existingApplication, command);
diff --git a/javatests/google/registry/flows/domain/DomainApplicationUpdateFlowTest.java b/javatests/google/registry/flows/domain/DomainApplicationUpdateFlowTest.java
index 1d6f7c4fd..657ad8fc1 100644
--- a/javatests/google/registry/flows/domain/DomainApplicationUpdateFlowTest.java
+++ b/javatests/google/registry/flows/domain/DomainApplicationUpdateFlowTest.java
@@ -35,6 +35,7 @@ import google.registry.flows.ResourceFlowTestCase;
 import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
 import google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException;
 import google.registry.flows.domain.DomainApplicationUpdateFlow.ApplicationStatusProhibitsUpdateException;
+import google.registry.flows.domain.DomainFlowUtils.ApplicationDomainNameMismatchException;
 import google.registry.flows.domain.DomainFlowUtils.DuplicateContactForRoleException;
 import google.registry.flows.domain.DomainFlowUtils.EmptySecDnsUpdateException;
 import google.registry.flows.domain.DomainFlowUtils.LinkedResourcesDoNotExistException;
@@ -399,6 +400,14 @@ public class DomainApplicationUpdateFlowTest
     runFlow();
   }
 
+  @Test
+  public void testFailure_applicationDomainNameMismatch() throws Exception {
+    persistReferencedEntities();
+    persistResource(newApplicationBuilder().setFullyQualifiedDomainName("something.tld").build());
+    thrown.expect(ApplicationDomainNameMismatchException.class);
+    runFlow();
+  }
+
   @Test
   public void testFailure_neverExisted() throws Exception {
     persistReferencedEntities();
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_add_remove_same_contact.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_add_remove_same_contact.xml
index bb17d9a55..f304bc025 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_add_remove_same_contact.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_add_remove_same_contact.xml
@@ -3,7 +3,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
         <domain:add>
           <domain:contact type="tech">sh8013</domain:contact>
           <domain:status s="clientHold"
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_authinfo.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_authinfo.xml
index 4b21111d6..89ab8f770 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_authinfo.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_authinfo.xml
@@ -3,7 +3,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
         <domain:chg>
           <domain:authInfo>
             <domain:pw>2BARfoo</domain:pw>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add.xml
index 10a9458f8..905ddcb54 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem.xml
index a6d94ea55..996e4706f 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem_same.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem_same.xml
index de6e99f49..d3100399b 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem_same.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_add_rem_same.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_empty.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_empty.xml
index 0cb66b499..fcddcf527 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_empty.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_empty.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem.xml
index 9e9c05a46..68e29d186 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all.xml
index fe773c0ed..0b3e290f3 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all_false.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all_false.xml
index 818c2f123..eabbf8383 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all_false.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_rem_all_false.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_urgent.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_urgent.xml
index 56503147f..813f80d56 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_urgent.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_dsdata_urgent.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_maxsiglife.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_maxsiglife.xml
index fb51d8349..dbf52fd99 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_maxsiglife.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_maxsiglife.xml
@@ -5,7 +5,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
       </domain:update>
     </update>
     <extension>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_registrant_to_tech.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_registrant_to_tech.xml
index a4096e355..72dbc4a03 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_registrant_to_tech.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_registrant_to_tech.xml
@@ -3,7 +3,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
         <domain:add>
           <domain:contact type="tech">sh8013</domain:contact>
         </domain:add>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_admin.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_admin.xml
index efdf2b0f4..37fcd216d 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_admin.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_admin.xml
@@ -3,7 +3,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
         <domain:rem>
           <domain:contact type="admin">sh8013</domain:contact>
         </domain:rem>
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_multiple_contacts.xml b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_multiple_contacts.xml
index 221926d4b..61d363865 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_multiple_contacts.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_sunrise_remove_multiple_contacts.xml
@@ -3,7 +3,7 @@
     <update>
       <domain:update
        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
-        <domain:name>example.com</domain:name>
+        <domain:name>example.tld</domain:name>
         <domain:add>
           <domain:contact type="admin">mak21</domain:contact>
           <domain:contact type="billing">mak21</domain:contact>