Wildcard DNS Record
What a Wildcard DNS Record Does
A wildcard DNS record is a record whose name starts with an asterisk, such as *.example.com. It gives one answer to every subdomain of the domain that does not have a record of its own.
Normally, DNS answers only for names that exist in the zone. If nobody created blog.example.com, a query for it returns a “name does not exist” response, called NXDOMAIN. A wildcard changes that result. The same query now returns the wildcard’s answer, so blog.example.com, shop.example.com and anything.example.com all resolve to the same place.
How Matching Rules Decide Which Record Wins
The server holding the zone first looks for a record with the exact name that was asked for. The wildcard is used only when no matching name exists. An explicit record always wins for its own name: if www.example.com has its own record, the wildcard is ignored for that name. Compare this with a plain A record, which answers for one name only.
Two rules often surprise people. First, a wildcard never covers the bare domain, example.com itself, which must be configured separately. Second, a wildcard applies only to names that do not exist at all. If a name has an A record but no MX record, a query for its MX record returns an empty answer, not the wildcard’s MX record, because the name already exists.
Common Uses and Trade-Offs
Wildcards are common where a service creates subdomains automatically. A software platform might give each customer an address such as customer-name.platform.example. One wildcard record can send all of those names to the same load balancer, so DNS does not need a new record for each customer.
The web server then chooses the content. It reads the host name in each HTTP request and serves the matching site. DNS delivers the visitor to the server; it does not decide what the visitor sees.
The trade-off is that every misspelled subdomain also resolves, which can hide mistakes. A wildcard MX record, which routes email, would accept mail for any name that does not exist, so it needs careful thought. A wildcard can also be a CNAME record that points to a shared hostname. A wildcard DNS record is not the same as a wildcard TLS certificate, which is a separate concept.
Frequently asked questions
Is a wildcard DNS record the same as a wildcard SSL certificate?
No. A wildcard DNS record decides where names resolve, while a wildcard certificate is a TLS certificate that covers many subdomains at once. The two are independent: you can use one without the other, and a wildcard DNS record does not make a site secure on its own.
Do explicit records override a wildcard DNS record?
Yes. If a specific record exists for a name, resolvers use it and ignore the wildcard for that name. The wildcard still answers for other names without records. Remember that a name with any record type does not fall back to the wildcard for other types. For the available options, see DNS record types.