This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.
You list the most inclusive domains such as example.com to include all of foo.example.com and bar.example.com. It should then allow you to create a deny policy for foo.example.com only, allowing anything not specifically listed, such as bar.example.com and everything else at example.com.