diff --git a/src/apps.js b/src/apps.js
index 600ac3a5f..2157b6408 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -1281,12 +1281,11 @@ function checkAppState(app, state) {
     return null;
 }
 
-async function validateLocations(locations) {
+async function validateLocations(locations, domainObjectMap) {
     assert(Array.isArray(locations));
+    assert.strictEqual(typeof domainObjectMap, 'object');
 
-    const domainObjectMap = await domains.getDomainObjectMap();
-
-    for (let location of locations) {
+    for (const location of locations) {
         if (!(location.domain in domainObjectMap)) throw new BoxError(BoxError.BAD_FIELD, `No such domain in ${location.type} location`);
 
         let subdomain = location.subdomain;
@@ -1298,8 +1297,6 @@ async function validateLocations(locations) {
         const error = dns.validateHostname(subdomain, domainObjectMap[location.domain]);
         if (error) throw new BoxError(BoxError.BAD_FIELD, `Bad ${location.type} location: ${error.message}`);
     }
-
-    return domainObjectMap;
 }
 
 async function getCount() {
@@ -1389,7 +1386,8 @@ async function install(data, auditSource) {
         .concat(redirectDomains.map(ad => _.extend(ad, { type: exports.LOCATION_TYPE_REDIRECT })))
         .concat(aliasDomains.map(ad => _.extend(ad, { type: exports.LOCATION_TYPE_ALIAS })));
 
-    const domainObjectMap = await validateLocations(locations);
+    const domainObjectMap = await domains.getDomainObjectMap();
+    await validateLocations(locations, domainObjectMap);
 
     if (settings.isDemo() && (await getCount() >= constants.DEMO_APP_LIMIT)) throw new BoxError(BoxError.BAD_STATE, 'Too many installed apps, please uninstall a few and try again');
 
@@ -1850,7 +1848,8 @@ async function setLocation(app, data, auditSource) {
         .concat(values.redirectDomains.map(ad => _.extend(ad, { type: exports.LOCATION_TYPE_REDIRECT })))
         .concat(values.aliasDomains.map(ad => _.extend(ad, { type: exports.LOCATION_TYPE_ALIAS })));
 
-    const domainObjectMap = await validateLocations(locations);
+    const domainObjectMap = await domains.getDomainObjectMap();
+    await validateLocations(locations, domainObjectMap);
 
     const task = {
         args: {
@@ -2281,7 +2280,8 @@ async function clone(app, data, user, auditSource) {
     const locations = [{ subdomain: subdomain, domain, type: exports.LOCATION_TYPE_PRIMARY }]
         .concat(secondaryDomains.map(ad => _.extend(ad, { type: exports.LOCATION_TYPE_SECONDARY })));
 
-    const domainObjectMap = await validateLocations(locations);
+    const domainObjectMap = await domains.getDomainObjectMap();
+    await validateLocations(locations, domainObjectMap);
 
     // re-validate because this new box version may not accept old configs
     error = checkManifestConstraints(manifest);