\x05 = length of the following hostname part, that’s how names are encoded in dns packets
domain.com => regexp=“\x06domain\x03com”
domain.info => regexp=“\x06domain\x04info”
test.com => regexp=“\x04test\x03com”
domain.local => regexp=“\x06domain\x05local”
sub.domain.test => regexp=“\x03\x06domain\x04test”
The trailing \x01\x01, to filter out false positives (as suggested by psamsig), looks like a good idea, but the first \x01 is actually query type, so it will match A record queries only. To match all record types, this should work (but I can’t test it now):
domain.com => regexp=“\x06domain\x03com.\x01”