domain (common) name format for TLD exlusion in DPI-SSL exlusion list

Can someone confirm what the official domain (common) name format for TLD exlusion in DPI-SSL exlusion list is? Does it include the leading '.' (period) or not? I've seen examples of both, and am struggling with exclusions not quite working right. For instance, to exclude all of *.microsoft.com (TLD and any sub-domains), do I enter "microsoft.com" or ".microsoft.com" {*.microsoft.com is not valid syntax}. I assume the exlusion list works this way - that you can exclude a TLD.