This allows you to restrict it to a domain (e.g. example.com) but not a sub-domain of that domain.

Ah I see, thanks for the clarification!