The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A wildcard subdomain fails for one of three different reasons: DNS never returns an address, DNS returns an address but the request cannot reach the origin, or HTTPS reaches the service but the certificate or hostname routing is wrong. Fix it from the authoritative DNS zone outward: verify the exact hostname and wildcard label, remove unintended overrides, compare authoritative and recursive answers, then check proxying, origin listeners, firewall rules, and certificate coverage.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use the complete hostname that fails, such as tenant.example.com or dev.blog.example.com. Do not troubleshoot only *.example.com; the asterisk is configuration syntax, not a hostname that a browser requests.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What a wildcard DNS record actually does
A wildcard is a fallback record. It supplies an answer when a queried name does not have a more-specific record in the relevant DNS zone. It does not create every possible subdomain, override explicit records, or make a web server accept arbitrary Host headers.
Cloudflare’s DNS documentation states, “Specific DNS records take precedence over wildcard records.” That behavior is also defined by RFC 4592. If app.example.com has its own A, AAAA, CNAME, delegation, or other applicable record, that record is used instead of the wildcard.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Match the wildcard to the name depth
| Requested name | Wildcard label in the example.com zone |
What it covers |
|---|---|---|
tenant.example.com |
* (shown as *.example.com) |
First-level names directly below example.com |
dev.blog.example.com |
*.blog (shown as *.blog.example.com) |
Names directly below blog.example.com |
tenant.www.example.com |
*.www (shown as *.www.example.com) |
Names directly below www.example.com |
example.com |
No wildcard match | The zone apex needs its own record |
An asterisk must be a complete DNS label. tenant.*.example.com is not a wildcard pattern; the asterisk in the middle is literal text. In a DNS provider’s relative-name field, enter * for first-level hosts or *.www for hosts below www, according to the provider’s zone editor.
A wildcard is not an apex or an unlimited-depth rule
A record for *.example.com does not answer for the apex example.com. It also does not automatically answer every deeper name. A request for dev.blog.example.com needs a wildcard at the appropriate level, such as *.blog.example.com, unless an explicit record supplies the answer.
Classify the failure before changing DNS
The browser’s symptom tells you which layer to inspect first. Record the exact hostname, the network where you tested it, and the complete error message.
| Symptom | What it usually means | First check |
|---|---|---|
| NXDOMAIN | The resolver found no associated DNS name or records. | Authoritative zone, delegation, wildcard label, and exact-name overrides |
| No address or empty answer | DNS exists but not for the queried record type, or the record is misconfigured. | A, AAAA, and CNAME records at the authoritative provider |
| Timeout | An address may exist, but the path, firewall, proxy, or listener is not responding. | Returned IP, routing, firewall, and service listener |
| Connection refused | The destination is reachable but no service accepts that port or protocol. | HTTP/HTTPS listener and origin port |
| HTTP 4xx or 5xx | DNS and transport worked; application or hostname routing rejected the request. | Reverse-proxy virtual host, Host header, and application configuration |
| Certificate warning | HTTPS reached a server, but the certificate does not cover the name or cannot be validated. | Certificate names, wildcard depth, SNI, and certificate chain |
| One generated name works and another does not | The names are not taking the same DNS or web path. | Specific records, delegation boundaries, name depth, and origin routing |
Step-by-step repair workflow
1. Write down the exact failing hostname
Use the full name a user enters, not just the zone. For example, distinguish tenant.example.com from dev.blog.example.com. Note whether the failure is NXDOMAIN, an empty DNS answer, a timeout, a refusal, an HTTP status, or a TLS warning. A DNS change will not repair a certificate mismatch, and a certificate change will not repair NXDOMAIN.
2. Edit the authoritative DNS zone
Find the domain’s authoritative nameservers by checking the parent-domain delegation or your registrar’s nameserver settings. The wildcard must be created at the provider named by those authoritative servers. A record entered at a different DNS dashboard cannot answer public queries, even if its interface shows the record as active.
Confirm that you are editing the correct zone. If the active zone is example.com, a first-level wildcard is entered as * or displayed as *.example.com. If the active zone is www.example.com, the same editor’s * represents *.www.example.com, not *.example.com.
3. Verify the record type, label, and destination
For a first-level tenant hostname, the usual records are:
| Record | Example | Use when |
|---|---|---|
| A | *.example.com → 203.0.113.20 |
The service has an IPv4 origin address |
| AAAA | *.example.com → 2001:db8::20 |
The service is intentionally reachable over IPv6 |
| CNAME | *.example.com → tenants.host.example |
Another hostname should supply the destination |
Use the destination supplied by the service you operate, and check every character of the target. An incorrect origin address can make DNS appear healthy while all web requests fail. If both A and AAAA records exist, test IPv4 and IPv6 independently; clients may prefer IPv6 and fail even when IPv4 works.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
4. Look for a record that overrides the wildcard
Inspect the exact hostname and each parent label. An explicit record at tenant.example.com wins over *.example.com. A delegation or other more-specific DNS structure can also prevent the wildcard from being used. This explains many cases in which one automatically generated subdomain works while another does not.
Remove an obsolete exact record only after confirming that the wildcard destination is appropriate for that name. If the name needs different routing, keep the explicit record and fix its target or web configuration instead of trying to force the wildcard to override it.
5. Compare authoritative and recursive DNS answers
Query the exact host and record types, rather than querying the asterisk:
dig tenant.example.com A
dig tenant.example.com AAAA
dig tenant.example.com CNAME
dig +trace tenant.example.com
nslookup tenant.example.comThe authoritative answer tells you what the zone currently publishes. A public recursive resolver may still hold an older positive or negative response until its cache and TTL expire. If the authoritative answer is correct but a recursive answer is old, wait for cache expiry and repeat the test. If both fail, fix the zone, delegation, label, or destination before changing the web server.
After an NXDOMAIN result, verify the active apex and subdomain records as well as the origin address. Cloudflare’s NXDOMAIN guidance specifically recommends checking those records and allowing caches to update after corrections.
6. Check proxy status and the origin path
DNS resolution proves only that a name maps to an address or target. It does not prove that a reverse proxy can reach the origin, that the origin listens on the expected port, or that a virtual host recognizes the requested name.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Decide whether the record should be proxied or DNS-only:
- Proxied: the proxy receives the client request and must be able to connect to the configured origin. Confirm routing, firewall allow-lists, the origin port, and the Host/SNI name the origin expects.
- DNS-only: the client connects directly to the returned address. The origin must accept HTTP or HTTPS itself, and its firewall, listener, routing, and certificate must all work for the public hostname.
Cloudflare documents the certificate consequence plainly: “Cloudflare can only serve an SSL/TLS certificate for a DNS record when you set the record’s proxy status to Proxied.” With a DNS-only record, the origin is responsible for TLS.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
7. Validate the certificate’s names and depth
A certificate for *.example.com covers first-level names such as tenant.example.com. It does not cover the apex example.com and does not automatically cover deeper names such as dev.blog.example.com. Those names need a certificate whose subject or SAN list explicitly includes them, or a wildcard at the corresponding level such as *.blog.example.com.
Check the certificate presented for the exact hostname, including the SNI name. Ensure the complete chain is installed and that the certificate is not expired or revoked. Wildcard issuance and renewal can require DNS-based domain-control validation; the precise validation requirement depends on the certificate setup. A DNS wildcard record alone does not prove that certificate validation has succeeded.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →8. Test from independent networks
Retest with a private browser window, a fresh recursive resolver, and an external DNS checker. Compare a normal connection with one made outside your office network or VPN. This distinguishes local cache, split-horizon DNS, VPN policy, filtering, and stale upstream data from a public DNS problem.
If public resolvers show the corrected answer but one device still reports NXDOMAIN, flush that device’s DNS cache or wait for its configured resolver to expire the old response. If every network fails in the same way, continue troubleshooting the authoritative zone or origin.
Why one wildcard subdomain works while another fails
An exact record is taking precedence
Suppose *.example.com points to a shared application, but billing.example.com has an old A record. Requests for billing.example.com use the old record, while newly invented names use the wildcard. Compare the complete record sets before assuming the wildcard is intermittent.
The names are at different levels
tenant.example.com is first-level; dev.blog.example.com is deeper. A wildcard at *.example.com is not a universal rule for the latter. Create the wildcard at the intended parent label or create an explicit record for the deeper hostname.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsA delegation creates a separate zone
If blog.example.com is delegated to different nameservers, records in the parent example.com zone do not control names below that delegation. Edit the authoritative child zone or remove the delegation only if that change is intended.
The DNS answers match, but web routing differs
Two names can resolve to the same IP while a reverse proxy or application routes them to different virtual hosts. Confirm that the origin accepts the requested Host header, that the TLS SNI name selects the expected certificate, and that the application has a tenant or site configuration for the name.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
IPv6 changes the path
A browser that receives both A and AAAA records may try IPv6 first. An unreachable AAAA destination can create timeouts even when the A record is correct. Remove an unintended AAAA record or make the IPv6 service and firewall path functional.
Keep DNS, transport, HTTP, and TLS checks separate
| Layer | Question to answer | Evidence of success |
|---|---|---|
| DNS | Does the exact hostname return the intended A, AAAA, or CNAME answer? | Authoritative and fresh recursive lookups agree |
| Transport | Can a client reach the returned address and port? | No timeout or refusal; the listener accepts the connection |
| HTTP | Does the proxy or origin route this Host header? | Expected status and application response |
| TLS | Does the certificate cover this name and validate correctly? | Certificate name, chain, and SNI all match |
Fix the earliest failing layer. Changing application routes cannot make an NXDOMAIN disappear, and adding a DNS record cannot make a closed HTTPS port listen.
Recommended Free Tools
Detailed tests for stubborn cases
When a basic lookup is inconclusive, compare record types and transport explicitly. Query A and AAAA separately so an unhealthy IPv6 path is not hidden by a successful IPv4 answer. Query CNAME as well, because a CNAME target can be missing, delegated elsewhere, or returning an unexpected address. Use an authoritative server directly, then repeat through at least one independent recursive resolver. Save the answer, TTL, flags, and timestamp so you can tell a stale response from a new configuration error.
For HTTPS, test the hostname rather than the IP address. The request’s Host header and TLS SNI value determine which virtual host and certificate are selected. A direct test to an origin IP can therefore produce a misleading success or failure. If a proxy is enabled, test the public endpoint and separately test the origin from an allowed network. Confirm that firewall rules permit the proxy’s documented source ranges and that the origin port configured in the proxy matches the listener.
For HTTP errors, inspect the reverse-proxy access and error logs at the exact request time. A 404 can mean the application has no tenant route; a 421 or similar response can indicate an SNI or Host mismatch; a 502 or 504 usually points to proxy-to-origin connectivity, port, or timeout settings. These are not repaired by adding another wildcard record.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common configuration pitfalls
- Duplicated suffixes: Some zone editors append the zone automatically. Entering
*.example.comin a field that expects a relative name can create an unintended name. Check the provider’s rendered FQDN. - Wrong record type: A CNAME cannot coexist with other data at the same owner name. Remove conflicting A or AAAA data only when the CNAME design is intentional.
- Unintended parked records: An old forwarding, verification, or parking record at the exact hostname takes precedence over the wildcard.
- Delegation boundaries: NS records for a child label move authority to another zone. Parent-zone edits will not change answers below that boundary.
- Negative caching: A previous NXDOMAIN can remain cached after you create the wildcard. Waiting for the negative TTL is required; repeatedly editing the record does not flush other resolvers.
- Split-horizon DNS: Internal resolvers may intentionally return private addresses or NXDOMAIN while public resolvers return the public wildcard. Decide which behavior is expected before changing the public zone.
- Certificate assumptions: A wildcard certificate is limited to one label of depth. It is not a blanket certificate for the apex or multi-level names.
Choosing a DNS or certificate service for wildcard use
If you are selecting a provider rather than repairing an existing zone, compare the capabilities that affect this workflow. Product limits and plan details change, so verify them with the provider before committing.
| Capability | Why it matters | Questions to ask |
|---|---|---|
| Wildcard A and CNAME support | Some workflows need address records; others delegate to a hostname. | Are wildcard A, AAAA, and CNAME records supported, and at which levels? |
| Authoritative nameserver control | The provider must actually answer public queries for the zone. | Who operates the authoritative servers, and how is delegation changed? |
| DNSSEC and API access | DNSSEC protects responses; an API enables repeatable tenant provisioning. | Are signing, key rotation, record creation, and deletion available? |
| Proxy versus DNS-only modes | Proxying changes the network path and who presents the edge certificate. | Can each record’s mode be chosen independently, and is origin access documented? |
| Wildcard certificate automation | Large numbers of names require reliable issuance and renewal. | Are wildcard certificates supported, and what DNS validation is required? |
| Propagation visibility and monitoring | Independent observations reveal stale or unexpected responses. | Are resolver checks, change history, alerts, and logs provided? |
| Geographic availability and limits | Regional restrictions or record quotas can affect a multi-tenant deployment. | Which regions, zones, API limits, and plan ceilings apply? |
Budget for the whole path, not just the DNS record. A provider may charge for managed DNS, API operations, proxy traffic, monitoring, or certificate features separately, while a certificate authority may impose its own validation or service requirements. Compare the published plan limits and renewal behavior with the number of tenant names you expect; do not assume that a free or entry-level plan includes wildcard automation, logs, or high-volume API access.
Prevent the next wildcard outage
- Document the authoritative nameservers and the zone in which each wildcard is defined.
- Record the intended depth: first-level
*.example.comversus deeper patterns such as*.www.example.com. - Keep an inventory of explicit records that intentionally override the wildcard.
- Provision DNS, proxy or DNS-only mode, origin virtual-host routing, and certificate names as one change.
- Monitor authoritative and recursive answers for representative generated hostnames.
- Test at least one IPv4 and one IPv6 path whenever both record types are published.
- After edits, record the change time and wait for the relevant positive or negative caches to expire before declaring propagation complete.
- Automate a canary hostname that exercises DNS, proxying, HTTP routing, and TLS renewal, and alert when any layer changes unexpectedly.
- Keep rollback records for the previous wildcard target, proxy mode, and certificate configuration so an incorrect bulk tenant change can be reversed safely.
Frequently Asked Questions
Why does *.example.com return NXDOMAIN?
Check that the wildcard exists in the zone served by the domain’s authoritative nameservers, that the label is exactly *, and that no child delegation changes authority. Query the exact hostname through an authoritative server and a public resolver. If the authoritative answer is fixed but the resolver still returns NXDOMAIN, wait for negative-cache expiry.
Why does the wildcard resolve but HTTPS fail?
Resolution only proves that DNS returned an address or target. Check whether the record is proxied or DNS-only, whether the origin listener and firewall allow the connection, and whether the certificate covers the requested name. A DNS-only record requires the origin to provide the certificate; a proxy must be able to reach the origin and use the expected Host/SNI.
Why does one subdomain work while another does not?
Compare their complete DNS paths. One may have an exact A, AAAA, or CNAME record that overrides the wildcard, sit below a delegated child zone, use a deeper name level, or route to a different virtual host. Also compare IPv4 and IPv6 answers and the certificates presented for each hostname.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can a wildcard record cover the root domain?
No. *.example.com covers matching names below the apex, not example.com itself. Create an explicit apex record and include the apex separately in the certificate’s names if HTTPS is required there.
Does *.example.com cover dev.blog.example.com?
Not automatically. The wildcard matches one label at its level. Use a wildcard such as *.blog.example.com in the appropriate authoritative zone or create an explicit record for the deeper hostname. The certificate must also cover that depth.
How long should I wait after correcting a wildcard?
Wait for the positive or negative TTLs that resolvers received before the change. Check the authoritative answer first; then compare several independent recursive resolvers. A local device, VPN, or split-horizon resolver can retain an older response after public resolvers have updated.
Should I remove an exact record that overrides the wildcard?
Only if the wildcard destination and routing are correct for that hostname. An explicit record may be intentional, such as a billing system or verification endpoint. Removing it can redirect traffic unexpectedly; otherwise repair its own target, proxy mode, origin route, or certificate.
What should I compare when choosing a wildcard DNS provider?
Compare wildcard A, AAAA, and CNAME support; authoritative nameserver control; DNSSEC and API access; proxy and DNS-only behavior; wildcard certificate issuance and renewal; propagation visibility, logs, and monitoring; geographic availability; and current pricing or plan limits.
The Bottom Line
Start with the exact hostname and the authoritative zone. Confirm the wildcard label and target, identify any overriding record or delegation, and compare authoritative answers with fresh recursive lookups. Once DNS is correct, troubleshoot proxy mode, origin connectivity, HTTP host routing, and certificate depth separately. A wildcard is only a DNS fallback; reliable access requires every layer to agree.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
