Hi!
My *strongly* preferred solution to the remaining 2% wildcarded domains would be to produce the non-wildcarded versions of domains that had actually occurred in spams.
I.e. if the current (discarded due to wildcarding) rule is
/\dmeds\d{2,6}.(?:com|net|biz)/
but the actual domain(s) that triggered the rule are
dmedsdd.com dmedsddd.net dmedsddddd.biz ...
Wont take much ram in DNS anyway, and there will be just one query, so even if you write down all possible ones its doable also.
Bye, Raymond.