diff --git a/src/main/java/org/cobbzilla/util/dns/DnsRecordMatch.java b/src/main/java/org/cobbzilla/util/dns/DnsRecordMatch.java
index 58e26f6..2fd34b3 100644
--- a/src/main/java/org/cobbzilla/util/dns/DnsRecordMatch.java
+++ b/src/main/java/org/cobbzilla/util/dns/DnsRecordMatch.java
@@ -49,7 +49,10 @@ public class DnsRecordMatch extends DnsRecordBase {
 
     public boolean matches (DnsRecord record) {
         if (hasType() && !getType().equals(record.getType())) return false;
-        if (hasFqdn() && !getFqdn().equalsIgnoreCase(record.getFqdn())) return false;
+        if (hasFqdn() && !getFqdn().equalsIgnoreCase(record.getFqdn())
+                && (!record.getFqdn().startsWith(".") || !getFqdn().equalsIgnoreCase(record.getFqdn().substring(1)))) {
+            return false;
+        }
         if (hasSubdomain() && record.hasFqdn() && !record.getFqdn().toLowerCase().endsWith(getSubdomain().toLowerCase())) return false;
         if (hasPattern() && record.hasFqdn() && !get_pattern().matcher(record.getFqdn()).find()) return false;
         if (hasFqdns() && record.hasFqdn() && getFqdns().stream().noneMatch(f -> record.getFqdn().equalsIgnoreCase(f))) return false;
diff --git a/src/main/java/org/cobbzilla/util/security/ShaUtil.java b/src/main/java/org/cobbzilla/util/security/ShaUtil.java
index 2f2a30d..9f652ff 100644
--- a/src/main/java/org/cobbzilla/util/security/ShaUtil.java
+++ b/src/main/java/org/cobbzilla/util/security/ShaUtil.java
@@ -29,7 +29,7 @@ public class ShaUtil {
 
     public static byte[] sha256 (String data) {
         try {
-            return sha256(data.getBytes(StringUtil.UTF8));
+            return sha256(data.getBytes(StringUtil.UTF8cs));
         } catch (Exception e) {
             return die("sha256: bad data: "+e, e);
         }