correct string termination in smtpd_sender_restrictions hash:-es?

[terrygalant . lists]

Hi,

I've added a sender restriction

        postconf -n
                ...
                smtpd_sender_restrictions = hash:/path/to/reject_senders, 
check_sender_access ... 
                ...

It's convenient for early rejection of lists of senders, and seems to work as 
expected for,

        cat /path/to/reject_senders
                ...
                b...@domain1.com    REJECT
                @domain2.com       REJECT
                ted@               REJECT
                domain3.com        REJECT
                ...

I'd like to add an early reject for all mail from the ".link" TLD. But, this

        .link              REJECT

added to /reject_senders would, I think, trigger on ANY instance of ".link", 
including, e.g., 

        y...@test.linkedin.com

So, I need to (somehow) terminate the match.

Is that correctly do-able in the hash: above?  E.g.,

        .link$    REJECT

or somesuch?  Or would that NEED to be in a regex match?  Or, other, better 
option?

With something as 'brute force' as whole-TLD rejection, I'd like to make sure I 
get this right!

Thanks for any advice/recommendations!

Terry