Recommended Free Tools
To send every otherwise-unmatched subdomain to one Linux VPS, define a wildcard owner such as *.example.com. in the authoritative BIND9 zone, then validate, reload, and query that server directly. The wildcard applies at one label below the zone and does not match the bare example.com. apex. Explicit records, DNS delegation, firewall access, SOA serials, and transfer security determine whether the setup works in production.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a BIND9 wildcard actually does
A DNS wildcard is a resource-record owner name whose leftmost label is an asterisk. In the example.com. zone, *.example.com. can answer for a name such as app.example.com. when no closer, explicit node exists. It is DNS authority data, not a shell glob and not a pattern that recursively matches any text.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Matches: otherwise-unmatched names at the wildcard’s label boundary, such as
app.example.com.. - Does not match: the zone apex
example.com.; create an@record for that name. - Does not override: an existing node such as
www.example.com., a delegation, or another closer node. - Does not provide arbitrary depth:
*.example.com.is not a general answer forhost.dev.example.com.. Add the appropriate wildcard at the required label or create explicit records.
BIND’s Administrator Reference Manual describes non-terminal wildcard warnings as usually resulting from misunderstanding the wildcard-matching algorithm (RFC 4592). Treat a wildcard as a default for a precise part of the namespace, not as recursive DNS redirection.
Choose the operating model before editing DNS
| Decision | Option A | Option B | Operational consequence |
|---|---|---|---|
| Addressing | One wildcard A/AAAA target | Explicit records per service | A wildcard is quick for many identical endpoints; explicit records are safer when services need different addresses, mail handling, verification records, or future migrations. |
| Change method | Manually edited zone file | Authenticated dynamic updates | File edits are easy to audit but require an SOA serial change and reload. Dynamic updates can automate changes when authorized with BIND’s update-policy controls. |
| Authority | One VPS as primary | Primary plus secondary servers | A single server is simpler but is a single failure domain. Separate secondary servers and networks improve resilience and require controlled transfers. |
| TTL | Short TTL | Long TTL | Short values let changes be observed sooner but increase query traffic. Long values reduce repeated queries but keep old answers cached longer after a change. Select a value for your change and failure-recovery requirements rather than treating one TTL as universal. |
The rest of this guide uses a static primary zone on a Debian/Ubuntu-style VPS. Paths and service names differ across distributions, so adapt them to the BIND package layout on your system.
Prerequisites: delegation, addressing, and network access
You need a registered domain, a stable public IPv4 address and, if you publish IPv6, a stable public IPv6 address for the VPS. BIND cannot become authoritative merely because it is installed; the parent domain must delegate your nameservers.
- Choose the nameserver hostnames that will answer authoritatively, for example
ns1.example.com.. - At the registrar, delegate the domain to those nameserver hostnames.
- If a nameserver hostname is inside the delegated domain, create the required registrar glue record so resolvers can find its address without a circular dependency.
- Permit inbound UDP port 53 and TCP port 53 in both the VPS firewall and the provider’s security group. Authoritative DNS uses both transports; allowing only UDP produces intermittent failures, especially for larger responses or retries.
- Ensure the VPS has the intended public address and that reverse-path, provider, and local firewall policies do not block DNS traffic.
Before troubleshooting zone syntax, confirm that the registrar actually delegates to the server you are editing. A perfectly valid local zone is irrelevant if public resolvers query different nameservers.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteInstall BIND9 and identify the authoritative configuration
Install the distribution’s BIND9 server and utilities package, including named-checkconf, named-checkzone, dig, and (where packaged) rndc. On Debian and Ubuntu layouts, local zones are commonly declared in /etc/bind/named.conf.local and stored under /etc/bind/zones/. Confirm ownership and permissions so the BIND service account can read the files.
Keep authoritative service separate from recursive service. A public authoritative VPS should not accidentally become an open recursive resolver. Decide explicitly whether recursion is disabled or restricted to trusted networks, and use query ACLs appropriate to that role.
Declare the primary zone
Add a zone statement naming the exact domain and the file that contains its records. BIND calls this role primary; older configurations may use the equivalent name master.
zone "example.com" {
type primary;
file "/etc/bind/zones/db.example.com";
allow-query { any; };
allow-transfer { none; };
};The file path is the source BIND loads for this zone. allow-transfer { none; }; prevents zone transfers until you deliberately operate a secondary. If you later add a secondary, replace that rule with the secondary’s addresses and apply transfer authentication and network restrictions appropriate to your design.
Create the directory if your distribution does not provide it, apply restrictive ownership and permissions, and keep a backup of every known-good zone version. Do not expose writable zone files to unrelated service accounts.
Write the zone file and place the wildcard correctly
The following illustrative file publishes the apex, the nameserver address, an explicit www exception, and a wildcard default. The serial uses the common YYYYMMDDnn convention: it is 2026101501 for the first change recorded on October 15, 2026.
$TTL 300
@ IN SOA ns1.example.com. hostmaster.example.com. (
2026101501 ; serial: YYYYMMDDnn
3600 ; refresh
900 ; retry
1209600 ; expire
300 ; negative cache TTL
)
IN NS ns1.example.com.
ns1 IN A 203.0.113.10
@ IN A 203.0.113.10
www IN A 203.0.113.10
* IN A 203.0.113.10A trailing dot marks a fully qualified domain name. Relative owners such as www and * inherit the zone origin, so they become www.example.com. and *.example.com.. The wildcard supplies an A answer for an otherwise-unmatched first-level name, while the explicit www node remains authoritative for www.example.com..
The apex A record is independent of the wildcard. Without the @ IN A ... line, a query for example.com. does not fall through to *.example.com.. Add an AAAA record when the VPS has a stable IPv6 address, and publish other record types deliberately:
- Use explicit A and AAAA records for services whose address or IPv6 behavior differs from the default.
- Define MX records for mail; do not assume the wildcard creates valid mail routing.
- Add TXT records explicitly for SPF, DKIM, domain verification, or other policies.
- Create ACME challenge records as required by the certificate client. A wildcard A record does not replace the TXT data used by DNS-01 validation.
- Use CNAMEs only where the DNS alias rules permit them; do not create a CNAME at a name that also needs SOA, NS, MX, or other data.
Place explicit service records before relying on the wildcard conceptually and in your review process. The important rule is that an existing closer node prevents wildcard synthesis for that node.
Understand wildcard boundaries before adding deeper names
One label below the owner
With *.example.com., one.example.com. can receive the wildcard answer. A request for one.dev.example.com. is at a deeper label and is not automatically covered by that owner. If you need defaults under dev.example.com., define a wildcard at that node, such as *.dev.example.com., subject to the same closer-node rules.
Rank #3
Existing nodes stop wildcard synthesis
If dev.example.com. exists because it has an A, NS, CNAME, or other data, the server considers that closer node when answering names beneath it. A wildcard at the parent cannot be used as a universal fallback through that node. Delegations create an authority boundary as well, so a child zone must answer for names below its delegation.
Non-terminal wildcard warnings
BIND’s check-wildcard option can check for non-terminal wildcards. The manual notes that these are almost always caused by a misunderstanding of the wildcard matching algorithm. Treat a warning as a design problem to resolve, not as an instruction to make the wildcard more recursive.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Validate the configuration before reloading
Run checks with an account that can read the configuration and zone files. Stop on any error; do not reload a partially edited file.
- Check global BIND syntax:
sudo named-checkconf
A successful command produces no error output and exits successfully. - Check the zone contents:
sudo named-checkzone example.com /etc/bind/zones/db.example.comnamed-checkzonereturns status 0 when no errors are detected and status 1 when errors are found. - Review warnings and integrity details: Check that the SOA owner, NS names, address records, and any glue-related names are intentional. BIND also performs post-load integrity checks for primary zones; use
named-checkzonefor checks involving out-of-zone names and glue.
If a zone is generated or compiled, named-compilezone can validate syntax and integrity while writing a specified output format. Do not run it on untrusted zone text: $INCLUDE directives can read files accessible to the invoking user.
Reload BIND only after a successful check
For a targeted reload, use:
sudo rndc reload example.comWhere supported by the distribution, a service reload is an alternative:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo systemctl reload bind9Afterward, inspect service status and logs. A reload command can return before you have examined a load error, so verify that the zone is reported as loaded and that no permission, syntax, or journal error was emitted.
Rank #4
Every manual zone edit must increment the SOA serial. If the serial remains unchanged, secondary servers and caches may continue using the previous version, and an attempted reload can appear successful while downstream data stays old. Keep the serial monotonically increasing; if you use a date-and-counter format, advance the counter for each edit on the same date.
Verify answers from the authoritative VPS
Query the server’s public address directly so a recursive cache cannot hide a delegation or reload problem.
dig @203.0.113.10 app.example.com A +noall +answer
dig @203.0.113.10 www.example.com A +noall +answer
dig @203.0.113.10 example.com SOA +noall +answerUse a test set that proves both the default and its boundaries:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Query at least two random labels, such as
alpha.example.com.andbeta.example.com., and confirm the wildcard address and expected TTL. - Query an explicit exception such as
www.example.com.and confirm its own record is returned. - Query the apex and inspect its SOA and A/AAAA data; the apex must be defined explicitly.
- Query a nonexistent deeper name, such as
x.dev.example.com., to confirm you are not assuming arbitrary-depth matching. - Run tests from an external network and verify both UDP and TCP port 53. A local query alone cannot prove registrar delegation or Internet reachability.
For a public delegation check, run dig +trace from a separate host and follow the chain from the root through the parent zone to your nameservers. Compare the delegated nameserver names and addresses with the VPS you actually configured.
Common failures and precise fixes
| Symptom | Likely cause | What to check or change |
|---|---|---|
| Wildcard query returns no answer | Zone is not loaded, the query reached another server, or a closer node exists. | Run named-checkzone, inspect BIND logs, query with dig @server, and inspect records or delegations at every closer label. |
| The apex does not resolve to the wildcard address | Wildcards never synthesize the zone apex. | Add or correct an explicit @ A/AAAA record. |
www still points elsewhere |
An explicit www node takes precedence. |
Edit the explicit record or remove it intentionally; do not expect the wildcard to override it. |
| Changes work locally but not publicly | Registrar delegation, glue, caching, or an unchanged SOA serial. | Use dig +trace, inspect the parent delegation, confirm glue, increment the serial, and query the authoritative address directly. |
| Intermittent timeout or truncated responses | UDP or TCP port 53 is filtered, or provider security rules differ from the VPS firewall. | Permit both transports and test from outside the hosting network. |
SERVFAIL |
Delegation, DNSSEC, transport, or zone-load failure. | Check journalctl -u bind9, BIND logs, dig +trace, DNSSEC status where applicable, and the loaded-zone message. |
| Secondary remains stale | SOA serial was not increased, transfer is blocked, or the secondary is not authorized. | Compare SOA serials, review allow-transfer, transfer authentication, and secondary logs. |
| Unexpected security exposure | Open transfers or unrestricted recursion. | Close allow-transfer unless required and configure recursion and query ACLs deliberately. |
Secure transfers and automated updates
Keep transfers closed by default
A public authoritative server should not offer its complete zone to arbitrary clients. Keep allow-transfer closed unless you operate a secondary. When a secondary is needed, permit only its fixed addresses and authenticate transfers where appropriate. Review provider-level firewalls as well as BIND ACLs.
Use authenticated dynamic updates for automation
For systems that must create or remove records automatically, BIND exposes update-policy and related controls. Policies can authorize identities using TSIG or SIG(0). Grant the narrowest names and record types needed by the automation, protect the key material, and log update activity. Do not make the zone writable to unauthenticated clients merely to avoid manual serial edits.
Best Value
Separate authoritative and recursive roles
Do not leave recursion broadly enabled on an Internet-facing authoritative VPS. Configure recursion and query ACLs for the role you intend, and verify from an outside network that unrelated clients cannot use the server as an open resolver.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Plan for changes, caching, and failure
The sample $TTL 300 is five minutes, but it is an example rather than a universal recommendation. A short TTL can make a migration or address correction visible sooner after caches expire, at the cost of more queries. A longer TTL reduces repeated lookups but prolongs old answers after a change. Set the value in line with how often the service moves and how quickly you must recover.
Back up the zone file and configuration before edits. Monitor authoritative answers from outside the VPS, including the wildcard, apex, explicit exceptions, and SOA serial. Alert on failed UDP and TCP queries, expired certificates, and unexpected delegation changes.
A single VPS is a single failure domain: power, network, host, or provider problems can make the entire domain unreachable. A primary/secondary arrangement on separate networks reduces that risk. It also introduces transfer authorization, serial tracking, and operational monitoring. BIND supports primary and secondary zone types; choose the arrangement based on the availability your domain requires rather than assuming a wildcard itself provides redundancy.
Practical deployment checklist
- Registered domain delegates to the nameserver hostnames you operate.
- Registrar glue exists when a nameserver hostname is inside the delegated domain.
- Stable public IPv4 and any intended IPv6 address are assigned to the VPS.
- UDP and TCP port 53 are allowed by both local and provider firewalls.
- The
zonestatement uses the correct origin, primary type, and readable file path. - The zone contains SOA and NS records, explicit apex data, and the intended wildcard owner.
- Exceptions such as
www, mail, TXT, ACME, CNAME, and IPv6 records are explicit where needed. named-checkconfandnamed-checkzonesucceed before reload.- SOA serial increases for every manual edit.
rndc reloador the distribution’s service reload completes without log errors.- Direct
digqueries prove random labels, exceptions, apex behavior, and deeper-name boundaries. - Transfers are closed or restricted to authenticated secondary servers, and recursion is not unintentionally open.
- Backups and outside monitoring are in place.
Bottom line
Author a wildcard as *.example.com. in the primary zone, define the apex and service exceptions explicitly, and treat delegation, serial management, validation, transport, and access control as equally important. Once the zone validates and the authoritative VPS answers correctly over UDP and TCP, the wildcard will provide a predictable default for otherwise-unmatched subdomains without overriding closer DNS data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
