Wildcard DNS Records: When to Use Them and the Traps to Avoid

A wildcard DNS record (written with a *) answers for any subdomain you have not explicitly defined — so *.example.com can catch anything.example.com at once. Wildcards are handy for some setups but carry subtle traps that surprise people. Here is when to use them and what to watch for.

How a wildcard works

A record like *.example.com matches any single label that does not have its own record. Query foo.example.com or bar.example.com and, if neither is explicitly defined, both get the wildcard's answer. It is a catch-all for undefined names.

Where wildcards are useful

• SaaS-style subdomains — where every customer gets customer.yourapp.com pointing at the same app, without creating a record per customer.
• Catch-all landing — sending any undefined subdomain to one place.

Trap 1: a more specific record wins

A wildcard only applies where no more specific record exists. The moment you add www.example.com, the wildcard no longer answers for www — the specific record takes precedence. This is by design, but catches people who expect the wildcard to always apply.

Trap 2: wildcards don't cross existing nodes

If a.example.com exists as a defined name, a wildcard will not magically answer for b.a.example.com the way you might assume — wildcard matching has specific rules about existing names in the tree that often surprise people. Test the exact names you care about.

Trap 3: they catch more than you meant

A wildcard answers for everything undefined — including typos and names you never intended to serve. That can mask mistakes (a mistyped subdomain still "works") and can have security implications if it points somewhere sensitive.

Trap 4: interaction with MX and CNAME

Wildcards interact awkwardly with record-type rules. A wildcard CNAME or MX can behave in non-obvious ways, especially combined with other records. Verify behaviour with dig against several real and made-up names before relying on it.

Frequently asked questions

Does a wildcard override my specific records?

No — the opposite. A more specific record always wins over the wildcard. The wildcard only answers for names that have no explicit record of their own, so your defined subdomains keep their real values.

Why does my wildcard not answer for a deeper subdomain?

Wildcard matching has particular rules around names that already exist in the zone tree, so a wildcard does not always cover deeper or nested names the way you might expect. Test the exact names with dig rather than assuming.

Are wildcards a security risk?

They can be, because they answer for any undefined name — masking typos and potentially directing unintended subdomains somewhere sensitive. Use them deliberately, and avoid pointing a broad wildcard at anything privileged.