Wildcard DNS record
A record whose name starts with an asterisk, such as *.example.com, that answers for any name under it that has no record of its own.
A record whose name starts with an asterisk, such as *.example.com, that answers for any name under it that has no record of its own.
Wildcard DNS record
A record whose name starts with an asterisk, such as *.example.com, that answers for any name under it that has no record of its own.
A wildcard is a fallback, not an override. A query for blog.example.com is answered by *.example.com only when blog.example.com does not exist at all; if blog has any record, of any type, the wildcard never applies to it. That rule catches people out: adding a TXT record to a name stops the wildcard answering its A query, which then returns no address. A wildcard also matches deeper names, so *.example.com answers a.b.example.com when b.example.com does not exist, which is wider than a wildcard SSL certificate, whose *.example.com covers one level only. Wildcards are useful for multi-tenant apps where every customer gets a subdomain, and risky elsewhere: every mistyped or invented subdomain resolves, which makes typos look like working sites and hands attackers ready-made names for phishing pages on your domain.
A zone holds *.example.com pointing at 203.0.113.10 and www.example.com pointing at 203.0.113.20. A lookup for shop.example.com returns 203.0.113.10 from the wildcard, www.example.com returns its own address, and anything.else.example.com also returns 203.0.113.10, because nothing closer to it exists.
Related terms A record CNAME record MX record
Monitor it DNS change detection
How to tell if a domain uses a wildcard record
- Look up a subdomain you know does not exist, such as a random string under the domain.
- If it returns an address, the zone has a wildcard answering for it.
- Check a real subdomain too: it answers with its own record, which the wildcard never overrides.
- Enter the domain below to read its live records.
The status label and the stage sentence above are the same ones Domainyze shows on a monitored domain.
- A record
- Maps a hostname to an IPv4 address. It is the record that answers "where is this website".
- AAAA record
- The IPv6 equivalent of an A record: it maps a hostname to an IPv6 address.
- CNAME record
- Aliases one name to another, so the resolver looks the second name up instead. Used to point a subdomain at a provider's hostname.
- MX record
- Names the mail servers that accept email for the domain, each with a priority number. The lowest number is tried first.
- NS record
- Names the authoritative nameservers for a zone. The registry publishes these for your domain, and they decide who answers every other question about it.
- TXT record
- Holds arbitrary text. It has no protocol meaning of its own, which is why so many systems use it to publish policy and verification strings.
- SOA record
- The start of authority: one record per zone, carrying the primary nameserver, the administrative contact and the timers that govern zone transfers and negative caching.
- CAA record
- Lists the certificate authorities permitted to issue certificates for the domain. A CA is required to check it before issuing.
- SRV record
- Advertises the hostname and port of a specific service for a domain, under a name that encodes the service and protocol.
- DS record
- The Delegation Signer record: a hash of your zone's signing key, published in the parent zone by the registry so a resolver can verify that the DNSSEC signatures in your zone are the right ones.
- DNS propagation
- The period after a DNS change during which some resolvers still answer with the old value, because they cached it before the edit.
- TTL (time to live)
- Time to live: how many seconds a resolver may cache a DNS answer before asking again. Set per record, and handed out with every answer.