No need to use asterisk, zenarmor will match all subdomains and fully qualified domain names under this domain. If you would like anyting under domain.com (sub.domain.com, host.sub.domain.com) be allowed or blocked, just put domain.com and we'll match all. CIDR notation is acceptable for IP addresses (host.sub.domain.com, domain.com, 172.16.1.1, 10.10.10.0/24).