Use wildcard DNS only for names that truly share the same routing destination and lifecycle. For customer mail, keep policy records, verification evidence, and activation decisions tenant-specific: a successful wildcard lookup proves only that DNS returned an answer, not that a customer controls the domain or that its mail configuration is ready.
Choose DNS records by failure boundary, not convenience alone
A wildcard can reduce repeated DNS changes when many matching names need identical routing. But shared routing also creates a shared failure boundary: a mistake in that route can affect every name relying on it. Discrete tenant records require more individual updates and checks, but make it easier to associate an expected value, an observed answer, and a change history with a particular customer.
As an Amazon Associate I earn from qualifying purchases.
| Decision axis | Shared wildcard routing | Discrete tenant records |
|---|---|---|
| Initial routing change | One change can serve matching names when their behavior is uniform. | Each tenant name needs a scoped change. |
| Verification attribution | Requires separate tenant-aware evidence. | Expected owner and value map directly to a tenant. |
| Failure and rollback scope | A bad shared route may affect all names that rely on it. | A change can be bounded to the tenant record. |
| Audit explanation | Requires mapping shared state back to individual tenants. | A tenant-specific history is easier to retain. |
| Operational load | Fewer repeated DNS writes when routing is genuinely common. | More writes, checks, and observations to manage. |
These trade-offs are operational analysis, not results from a measured comparative study; the scenario-specific proposal is described in the September 27, 2026 article on media mail cutovers. Choose the smallest failure boundary that meets your revocation and audit needs. A practical hybrid is shared routing for uniform ingress or preview behavior, alongside tenant-scoped mail policy and verification.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What a wildcard DNS answer does—and does not—mean
DNS wildcards do not simply guarantee the same answer for every possible subdomain. Under the DNS tree rules described in RFC 4592, synthesis depends on the closest encloser, and an existing node can change which answer is synthesized. Treat a wildcard as a routing convenience with defined DNS behavior, not as an unconditional catch-all.
#1 Best Overall
Even when a lookup returns the intended answer, that result establishes only that the queried name resolved from the perspective of that lookup. It does not by itself establish customer control of the namespace, correctness of mail-authentication records, or approval to send. Those are separate checks and should produce separately attributable evidence.
Keep SPF, DKIM, and DMARC checks specific to the mail identity
SPF authorizes particular domain uses
RFC 7208 defines SPF checks for a domain used in the HELO and MAIL FROM identities. SPF is published as a DNS TXT record, and multiple records that cause an authorization check to select more than one SPF record are not allowed. An SPF record at a domain apex should not be assumed to cover every tenant subdomain; wildcard use requires care, and relevant names or subtrees may need their own declarations. The RFC’s section 3.5 cautions: “Use of wildcard records for publishing is discouraged, and care has to be taken if they are used.”
Rank #2
DKIM lookup uses the selector and signing domain
DKIM verification retrieves public-key material using the selector and signing domain in the message signature. A generic wildcard TXT answer is not a substitute for checking the specific key record: RFC 6376 warns that a wildcard TXT record covering a DKIM lookup is unlikely to return a valid DKIM key record.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDMARC checks alignment with the Author Domain
RFC 9989 is the current DMARC specification identified by the RFC Editor as superseding RFC 7489. DMARC uses SPF and DKIM results together with identifier alignment to relate authentication to a message’s Author Domain; domain owners publish a policy and can receive reports. Evaluate the policy relevant to the sending identity rather than treating a generic successful DNS response as a DMARC pass.
Represent customer verification as observable states
Keep records that let an operator answer what was requested, what DNS returned, which checks passed, and who approved release. A tenant-aware record should retain:
- the tenant and domain being onboarded;
- the exact expected DNS owner names and values;
- the observed answers and observation timestamps;
- the results of applicable policy checks; and
- the release revision or decision associated with activation.
Represent the lifecycle explicitly—for example, requested, observed, policy-verified, active, and drifted. This vocabulary is an application-design recommendation, not a state machine required by an IETF standard. Keeping the states distinct prevents a routing observation from being mistaken for proof of authorization or release approval.
Run the cutover as a gated workflow
- Record the request. Associate the customer, domain, intended sending identity, and expected owner names and values with a pending tenant record.
- Publish the required DNS changes. Use shared wildcard routing only for behavior that is uniform; publish or preserve tenant-specific mail-policy records where the sender’s configuration requires them.
- Observe and compare. Query the relevant names and preserve each observed answer with its timestamp. Compare the response with the exact expected owner and value rather than recording only a green or red status.
- Evaluate the applicable mail checks. Check the SPF, DKIM, and DMARC evidence that applies to the sender and domain. Record policy results separately from basic DNS resolution.
- Make an explicit release decision. Activate only after the checks required for that sender have passed and an authorized release decision is recorded. Do not let one successful lookup silently stand in for all checks.
- Monitor for drift. Continue observing the expected values and move the tenant into a drifted state when later observations no longer match the recorded configuration.
This gate and lifecycle are operational guidance in the cutover design proposal, not a standardized IETF workflow.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Handle delays and rollback without overstating propagation
If required checks have not passed by the launch deadline, keep the tenant pending and retain its established sending identity rather than forcing an incomplete cutover. Querying from multiple resolver perspectives can strengthen release evidence, but neither a fixed resolver count nor a single elapsed time guarantees that every resolver worldwide has the same view.
Best Value
Bound and record retries. Rewriting a record after each failed observation does not flush cached DNS data and can make the evidence trail harder to interpret. The available proposal supplies no empirically validated retry interval, propagation distribution, or success rate, so an implementation should set its own policy without presenting an invented interval as a guarantee.
For rollback, record both when the application decision changed and what later DNS observations returned. Cached answers can remain visible after the application has changed its release state; preserving both events distinguishes the operational decision from what resolvers continued to report.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
