If your user is failing to log in to Salesforce, and their login history is showing the error 'Restricted Domain,' it is probably because they are attempting to access Salesforce via a saved bookmark link, or they are not logging in from the correct domain URL.
If you are an administrator, check your org's domain restriction settings by navigating to:
If "Prevent login from https://login.salesforce.com" is enabled, all users in the environment will need to use your Salesforce instance's unique MyDomain URL to login.
Users logging in to a Sandbox directly through Production (via Setup | Sandboxes) can encounter this same issue if "Prevent login from https://test.salesforce.com" is enabled. Logging in from Production to a Sandbox will route the user to the respective Sandbox's default url https://<instance>.salesforce.com instead of the Sandbox's domain
000387792

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.