Skip to main content
miji.be

Wildcard DNS

A DNS configuration that uses an asterisk (*) to point all subdomains to a single IP address with one record, enabling efficient management of large numbers of subdomains.

Aug 24, 2026 / About 1 min read

Redirect

Wildcard DNS is a DNS record configuration that uses an asterisk (*) in the hostname field to direct any subdomain to the same IP address or domain with a single record. Setting "*.example.com" routes abc.example.com, xyz.example.com, and anything.example.com to the same server.

The configuration is as simple as "*.example.com A 192.0.2.1." If an explicit record exists for a specific subdomain, it takes precedence; the wildcard acts as a fallback. The matching rules have subtleties: a wildcard matches even when several labels remain, but it is not used when another name exists between the queried name and the wildcard's parent. foo.bar.example.com matches *.example.com, yet once bar.example.com holds any record the match stops working and a separate *.bar.example.com is needed.

In URL shortening services, wildcard DNS enables per-user custom subdomains. Assigning "user1.short.example.com" and "user2.short.example.com" to individual users requires no per-subdomain DNS records when a wildcard is in place. The server inspects the Host header to identify the user.

SaaS platforms use wildcard DNS widely as well. When every customer receives a subdomain, a wildcard means no DNS record has to be added as tenants arrive, which makes it the default choice for products of that shape. Once subdomains reach the thousands, issuing and retiring individual records stops being practical to operate.

A key caveat is that wildcard DNS accepts requests for any subdomain, including non-existent ones. The server must validate the requested hostname and return an appropriate error page for unknown subdomains. Combining wildcard DNS with a wildcard SSL certificate (*.example.com) enables HTTPS across all subdomains.

Was this article helpful?

Related Terms

DNS Resolution

The process of translating a human-readable domain name into the IP address of the server hosting the website.

A Record

A DNS record that maps a domain name to an IPv4 address. The foundational building block of web hosting.

CNAME Record

A CNAME record maps one domain name to another in DNS. Used to point custom branded short URL domains to the URL shortening service infrastructure without changing IP addresses directly.

Custom Domain

A privately owned domain name used with a URL shortening service instead of the service's default domain.

Subdomain

A prefix added before the main domain name, used to organize different sections or services of a website.

Subdomain Takeover

An attack in which a third party takes over a subdomain where an unused CNAME record remains, and exploits the trustworthiness of the legitimate domain.

Related Articles

What Is a Domain Name? A Friendly Guide to Internet Addresses

Learn how domain names work as internet addresses. Covers TLDs like .com and .jp, domain registration, uniqueness, and how domains relate to URLs.

How Custom Short URLs Boost Brand Recognition

Discover how branded short URLs strengthen brand identity. Learn strategies for creating memorable custom URLs that increase trust and CTR.

Self-Hosting a URL Shortener: Full Link Control

Explore the benefits and challenges of running your own URL shortening service. Covers open-source tools, serverless architecture, and cost-performance tips.

FAQ

When is wildcard DNS used?
It is common in SaaS platforms that assign subdomains per customer, multi-tenant applications, and URL shortening services with custom domain features. It eliminates the need to create individual DNS records for each subdomain.
What are the security risks of wildcard DNS?
Because any subdomain resolves to your server, requests for non-existent subdomains also arrive. The server must validate hostnames and return a 404 for unrecognized subdomains.
Do I need a wildcard SSL certificate?
A single wildcard certificate (*.example.com) is the simplest way to serve HTTPS on every subdomain. Issuing a separate certificate per subdomain also works, but issuance and renewal get harder to manage as the count grows. Let's Encrypt issues wildcard certificates for free, yet only through the DNS-01 challenge, which proves ownership with a DNS TXT record; HTTP-01 cannot issue them. That assumes DNS records can be updated automatically.

Put the terms to work

Shorten a URL for Free