which one is actually supposed to match krypton-oozie.red.funspace.notTLD, both *.funspace.notTLD and *.red.funspace.notTLD?