An exact hostname ("example.com") or a wildcard covering subdomains ("*.example.com"). Case-insensitive; no port/scheme component. Omit entirely (or use "*") for a general, non-domain-specific fallback rule. An exact-hostname match always takes precedence over a wildcard match, which always takes precedence over the general fallback.