ensure domains can be wildcards

@smn not entirely - the `-` will still be a problem