Wildcard DNS

Wildcard DNS is a special entry in DNS configuration in which an asterisk (*) is used in place of a subdomain name. Such a record matches all subdomains that have not been defined separately and directs them to a specified address. Instead of creating an entry for every subdomain individually, one record handles any number of them.

How the asterisk works in DNS

When a query reaches a DNS server, it first checks for records that exactly match the requested name. If none exists but a wildcard record does, the server uses it. For example, an entry for *.example.com will answer queries for shop.example.com, blog.example.com or any other previously undefined subdomain. A wildcard is most often implemented as an A or CNAME record, and how long it is cached depends on the TTL parameter.

Uses and pitfalls

Wildcard DNS is convenient in SaaS-type services, where each customer gets their own subdomain, and anywhere subdomains are created dynamically and making separate records would be impractical. But its limitations must be kept in mind: a wildcard record does not apply if any other record exists for a given branch, and overly broad use can direct traffic to unexpected addresses. A separate matter is encryption — for all subdomains to work over HTTPS, a wildcard certificate (*.domain) is needed, since wildcard DNS only routes traffic without securing the connection. A sensibly configured wildcard simplifies managing a large number of subdomains, but requires awareness of which names you actually intend it to cover.