In RFC 2109 an explicitly set domain must always start with a `.` (section 4.2.2). Only if the domain is omitted will the  leading `.` be missing (section 4.3.1). Based on the domain matching examples, the rules seem like a cookie's inclusion in a request should rely on:

* Secure flag matching.
* Domain matching request host exactly (for default values)
* Domain matching request host at the end of the domain,
* Path matching the request path at the beginning of the path.
* Cookie not being expired.