# Wildcard DNS records

Canonical: https://inetgeek.com/dns/wildcard-record/

A wildcard record answers for any subdomain you have not defined explicitly. It is useful and it is a common way to create surprises.

## What a wildcard matches

A record whose name begins with an asterisk label — *.example.com — answers queries for any name at that level which has no record of its own.
Wildcards are the usual way to serve a subdomain per customer without adding a record for each one.

## What a wildcard record looks like

A wildcard is an ordinary record whose name begins with an asterisk label: *.example.com. 3600 IN A 192.0.2.1. Nothing else about it is special, and any record type can be published this way.
The asterisk must be the whole leftmost label. A name like www*.example.com is not a wildcard, it is a literal name containing an asterisk, and it matches only itself.

## Any explicit record wins

A wildcard only applies where nothing else exists. If app.example.com has any record of its own, the wildcard never applies to it — and that is true per name, not per record type.
This surprises people: adding a TXT record to app.example.com for a verification check stops the wildcard A record from answering for app.example.com too, and the subdomain goes dark.

(Interactive explainer on the canonical page — nothing to check live, this is reference text.)

## Deeper names are a special case

Wildcard matching is defined in RFC 4592. *.example.com does match a.b.example.com, but only while no name exists between them: the moment b.example.com gets a record of its own, everything beneath it stops matching the wildcard.
A wildcard also cannot solve certificates: a wildcard TLS certificate for *.example.com covers one label, for the same reason.

## Related records

- [A record](https://inetgeek.com/dns/a-record/): Maps a hostname to an IPv4 address.
- [CNAME record](https://inetgeek.com/dns/cname-record/): Points one hostname at another name.
- [TXT record](https://inetgeek.com/dns/txt-record/): Holds arbitrary text, used for verification and email policy.