Wildcard DNS: Catch All Subdomains

Wildcard records let you respond to all undefined subdomains with a single DNS entry.

A wildcard DNS record (*.example.com) responds to any subdomain that doesn't have an explicit record. Instead of creating individual records for blog.example.com, shop.example.com, and api.example.com, a single wildcard handles them all. This is powerful for dynamic environments where new subdomains are created frequently.

Wildcards are extensively used in multi-tenant SaaS platforms where each customer gets their own subdomain (customer1.app.com, customer2.app.com). Without wildcards, you'd need to add DNS records every time a customer signs up - wildcards make this instant and automatic.

However, wildcards come with trade-offs: they can mask typos in subdomains, complicate email security (SPF/DKIM), and have specific interactions with SSL certificates. Understanding these nuances is essential before implementing wildcards.

How Wildcard DNS Works

Understanding wildcard record behavior:

  • Asterisk notation: The wildcard character (*) only works as the leftmost label: *.example.com is valid, but sub.*.example.com is not.
  • Lowest priority: Wildcards only match when no explicit record exists. www.example.com with an A record beats *.example.com wildcard.
  • Single level only: *.example.com matches foo.example.com but NOT foo.bar.example.com. For deep subdomains, you need *.bar.example.com.
  • Type-specific: Wildcards are record-type specific. *.example.com A record doesn't affect MX queries. You need separate wildcards for each type.

Wildcard DNS Use Cases

Wildcards solve several common challenges:

  • Multi-tenant SaaS: Each customer gets tenant.yourapp.com automatically. No DNS provisioning delay, instant subdomain activation.
  • Development environments: feature-123.dev.example.com, pr-456.staging.example.com - developers create branches freely without DNS tickets.
  • Content delivery: Images on img1.cdn.example.com, img2.cdn.example.com... Wildcard lets you add CDN nodes without DNS changes.
  • Vanity URLs: user.yoursite.com for profiles or portfolios. Users choose their subdomain, application handles routing.

Configure Wildcard DNS

Setting up wildcards properly:

  1. Add the wildcard record: Create *.example.com pointing to your server IP or CNAME target. Most DNS providers support this in their UI.
  2. Keep explicit records: Add explicit records for www, mail, and other critical subdomains. These override the wildcard, giving you control.
  3. Configure your server: Your web server must be configured to handle arbitrary hostnames. Use catch-all virtual hosts or application routing.
  4. Handle SSL certificates: Standard SSL certs don't cover wildcards. You need a wildcard certificate (*.example.com) or dynamic cert issuance.

Wildcard DNS Examples

Configuration and testing:

; Basic wildcard configuration
*.example.com.     IN A     203.0.113.10
*.example.com.     IN AAAA  2001:db8::10

; Explicit records override wildcard
www.example.com.   IN A     203.0.113.20
mail.example.com.  IN A     203.0.113.30

; Wildcard for subsubdomains
*.dev.example.com. IN CNAME dev-pool.example.com.

; Wildcard CNAME (for SaaS platforms)
*.customers.example.com. IN CNAME lb.example.com.

# Test wildcard resolution
$ dig random123.example.com +short
203.0.113.10

$ dig anythingworks.example.com +short
203.0.113.10

# Explicit record takes precedence
$ dig www.example.com +short
203.0.113.20

# Test deep subdomain (won't match *.example.com)
$ dig foo.bar.example.com +short
(no response - no record matches)

Remember: wildcards only match one level deep. *.example.com matches anything.example.com but NOT deep.sub.example.com.

Wildcard Best Practices

Use wildcards effectively and safely:

  • Explicit over implicit: Always create explicit records for known subdomains. Wildcards are fallbacks, not replacements for intentional configuration.
  • Monitor for abuse: Wildcards can be abused for phishing (paypal-login.yoursite.com). Monitor logs and implement subdomain validation in your app.
  • Email considerations: Wildcards complicate email security. Ensure explicit MX records and SPF/DKIM don't rely on wildcard behavior.
  • Use wildcard certs: Wildcard DNS requires wildcard SSL certificates. Let's Encrypt supports them with DNS-01 challenge validation.

Wildcard Implementation Checklist

  • Wildcard record created (*.domain.com)
  • Explicit records for www, mail, and critical services
  • Web server configured for catch-all virtual host
  • Wildcard SSL certificate obtained and installed
  • Application validates and sanitizes subdomain input
  • Monitoring for unexpected subdomain usage

FAQ - Wildcard DNS

Can wildcards match multiple levels?

No, *.example.com only matches single-level subdomains. For sub.sub.example.com, you need *.sub.example.com explicitly.

Do wildcards work for all record types?

Wildcards work for most record types (A, AAAA, CNAME, TXT, etc.) but some providers restrict certain combinations. MX wildcards are particularly tricky.

Can I have a wildcard and explicit records together?

Yes, explicit records always take precedence. www.example.com will use its explicit A record, not the *.example.com wildcard.

How do wildcards affect SSL certificates?

Standard certificates don't cover random subdomains. You need a wildcard certificate (*.example.com) which covers *.example.com but not example.com itself.

Are wildcards bad for security?

They can be misused for phishing if not controlled. Implement subdomain validation in your application and monitor for suspicious patterns.

Does MoniTao support wildcard monitoring?

Yes, MoniTao can monitor specific subdomains created by wildcards. We also alert you if your wildcard record changes or is removed.

Leverage Wildcard DNS Effectively

Wildcard DNS is a powerful tool for dynamic environments, multi-tenant platforms, and development workflows. It eliminates DNS provisioning as a bottleneck for subdomain creation.

Use wildcards judiciously: maintain explicit records for critical services, obtain wildcard SSL certificates, and monitor for abuse. MoniTao helps you track both your wildcard configuration and the subdomains it enables.

Useful Links

Ready to Sleep Soundly?

Start free, no credit card required.

Create My Account See pricing