What is a Wildcard DNS Record? How It Works and When to Use It
Understand when wildcard DNS answers a name, how existing records affect matching and why TLS configuration is separate.
The named scenario below is a worked example for learning, not a verified incident report. Provider settings and outcomes vary.
Wildcard DNS Matching Flow
xyz.example.com
Check for xyz record
Exact record not found
*.example.com exists?
Wildcard applies
Returns wildcard IP
🎯 Illustrative example: Pooja's SaaS Uses Wildcard for Custom Subdomains
Pooja's SaaS app gives each customer a subdomain (customer1.app.com). She sets up a wildcard record:
Creates wildcard A record
*.app.com → 10.0.5.1 — any subdomain now resolves to her server.
New customers work instantly
customer1.app.com, customer2.app.com — all resolve without adding individual records.
Typos also resolve!
asdfgh.app.com resolves too — users who mistype URLs see her app instead of an error.
API subdomain issue
She created api.app.com as a CNAME → load balancer. The explicit record overrides the wildcard — this is correct.
SSL challenge
Wildcard SSL cert (*.app.com) covers all subdomains. But she needs a separate cert for app.com (root).
Final setup works
Wildcard for customer subdomains + explicit records for api, mail, www. Clean and scalable.
Wildcard DNS lets her onboard new customers without any DNS changes.
Watch out: wildcard catches ALL subdomains including typos and unintended ones.
What is a Wildcard DNS Record?
A wildcard DNS record uses an asterisk (*) as the subdomain label. It acts as a catch-all — any DNS query for a subdomain that doesn't have its own specific record will be answered by the wildcard record.
Example Wildcard A Record
*.example.com. 300 IN A 93.184.216.34
This means blog.example.com, shop.example.com, anything.example.com all resolve to 93.184.216.34 — unless a specific record exists for that subdomain.
How Wildcard Matching Works
Wildcard records follow specific rules defined in RFC 4592:
Rule 1: Single Level Only
*.example.com matches blog.example.com but NOT sub.blog.example.com. Wildcards only match one label level.
Rule 2: Explicit Records Take Priority
If you have both *.example.com → 1.2.3.4 and www.example.com → 5.6.7.8, queries for www return 5.6.7.8. The wildcard only matches subdomains without explicit records.
Rule 3: Leftmost Label Only
The asterisk must be the leftmost (first) label. *.example.com is valid. mail.*.example.com is NOT valid.
| Query | Explicit Record? | Result |
|---|---|---|
| blog.example.com | No | ✓ Matches wildcard |
| shop.example.com | No | ✓ Matches wildcard |
| www.example.com | Yes (A → 5.6.7.8) | Uses explicit record |
| sub.blog.example.com | No | ✗ No match (2 levels deep) |
| example.com | — | ✗ No match (apex domain) |
When to Use Wildcard DNS Records
Multi-Tenant SaaS Apps
Each customer gets their own subdomain (e.g., acme.yourapp.com). The wildcard points all subdomains to your server, and the app routes based on the hostname.
Development & Staging Environments
Create unlimited subdomains for feature branches: feature-login.dev.example.com, bugfix-42.dev.example.com.
Catch-All Web Routing
Point all subdomains to a web server that handles routing internally (e.g., WordPress multisite, custom proxy).
Wildcard SSL Certificates
Pair with a wildcard SSL certificate (*.example.com) to enable HTTPS on all subdomains without individual certificates.
Common Pitfalls to Avoid
Typo Subdomains Resolve
With a wildcard, wwww.example.com or typo.example.com will resolve instead of returning NXDOMAIN. This can mask misconfigurations and create SEO issues with duplicate content.
Email Issues
A wildcard MX record (*.example.com MX) means any subdomain accepts email. This can be exploited by spammers sending to anything@random.example.com.
SSL Certificate Mismatch
If you don't have a wildcard SSL certificate, subdomains matched by the wildcard DNS will show certificate warnings in browsers.
Subdomain Takeover Risk
If your wildcard CNAME points to an external service and you decommission it, attackers may claim that service endpoint and serve malicious content on your subdomain.
How to Create a Wildcard Record
In most DNS providers, create a new record with these settings:
Verify with dig:
dig random-test.example.com A +short
If it returns your server's IP, the wildcard is working. Use our DNS Lookup tool for a quick check.
Frequently Asked Questions
What is a wildcard DNS record?
A DNS record using * as the subdomain label. It matches any query for a subdomain that doesn't have its own explicit record — acting as a catch-all.
Does *.example.com match example.com itself?
No. The wildcard only matches subdomains, not the apex (root) domain. You need a separate A record for example.com.
Can I use wildcard CNAME records?
Yes. *.example.com CNAME proxy.example.com is valid. All unmatched subdomains will be aliased to proxy.example.com. Just ensure the target handles all hostnames correctly.
Related Articles & Tools
CNAME vs A Record
When to use each DNS record type
How DNS Works
Full DNS resolution process explained
DNS Lookup Tool
Test wildcard DNS resolution for any domain
SSL/TLS for Beginners
Understand wildcard SSL certificates