What is a wildcard DNS record?
How matching works
When someone looks up a name like blog.example.com, DNS first checks for an exact record. If none exists, it can use a wildcard record that matches that level. A wildcard catches many names with one entry, which is handy for multi-tenant apps or catch-all setups.
The wildcard only applies to one level of subdomain in most setups. A name like a.b.example.com may not match *.example.com. The bare domain example.com is also separate and needs its own records.
- Matches names without exact records
- Does not override existing records
- Does not cover the bare domain
- Usually covers one subdomain level
Using it carefully
Wildcard records are simple to set up, but they can hide typos and misconfigurations because almost any subdomain will resolve. Consider whether you really need the broad match before adding it.
If you use a wildcard certificate with it, check that the certificate covers the same names. Mismatches cause browser warnings.
Wildcard records are often used for hosted platforms that give each customer a subdomain. Consider using explicit records for important names so they stay predictable. Test a few random names to confirm the behavior you expect. Document why the wildcard exists so teammates understand it later.
Common mistakes
- Assuming a wildcard covers the bare domain.
- Using a wildcard and then wondering why a specific subdomain points somewhere unexpected.
