A key element of "admit_hostnames" that I completely forgot to document:

If a hostname starts with a dot, then it is matched as a subdomain. E.g. ".cfengine.com" will match all IPs that reverse-resolve in that domain, like www.cfengine.com. It will *not* match IPs that reverse-resolve to cfengine.com. You need to add the domain without the leading dot for exact matches. E.g. ```{".cfengine.com","cfengine.com"}``` will match both domain and all subdomains.