Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,7 @@ sidebar:

import { Details, Example, Render } from "~/components"

Normal DNS records map a domain name to one or multiple IP addresses or other associated resources to a specific domain name (a one-to-many mapping).

Wildcard DNS records allow you to have a many-to-many mapping, for example if you had hundreds or thousands of subdomains you wanted to point to the same resources. Wildcard records are used as the response for all subdomains that are not specifically covered by another DNS record.
Normal DNS records map a domain name to one or multiple IP addresses or other associated resources to a specific domain name (a one-to-many mapping). Wildcard DNS records allow you to have a many-to-many mapping, for example if you had hundreds or thousands of subdomains you wanted to point to the same resources.

Within Cloudflare, wildcard DNS records can be either [proxied or DNS-only](/dns/proxy-status/).

Expand Down Expand Up @@ -46,28 +44,49 @@ You can also create a wildcard DNS record specifically for a deeper subdomain. F

### Aspects to consider

* **Wildcards are only supported on the first label**: This means that a hostname such as `subdomain.*.example.com` is not a wildcard on the level of the asterisk character. If you create a DNS record with that name, the asterisk is interpreted as the literal character `*` and not as the wildcard operator.
#### Wildcards are only supported on the first label

This means that a hostname such as `subdomain.*.example.com` is not a wildcard on the level of the asterisk character. If you create a DNS record with that name, the asterisk is interpreted as the literal character `*` and not as the wildcard operator.

#### Wildcards are multi-level by default

* **You cannot create wildcards on multiple levels**: If you create a DNS record on `*.*.example.com`, only the first asterisk is interpreted as a wildcard while the second one is interpreted as the literal `*` character.
If you create a DNS record on `*.*.example.com`, only the first asterisk is interpreted as a wildcard while the second one is interpreted as the literal `*` character. A record `*.example.com` is already multi-level by default, meaning it would cover `abc.example.com` as well as `123.abc.example.com`, as long as there are no [specific DNS records](#specific-dns-records-take-precedence-over-wildcard-records) that would take precedence.

* **Specific DNS records take precedence over wildcard records**: Wildcards will be applied for multiple levels, but a specific record on any equal or lower level will terminate anything on or below this specific record.
#### Specific DNS records take precedence over wildcard records

A wildcard record applies only when no exact record exists at the queried name. If a record or delegation exists, the wildcard does not apply.

<Details header="Example">
<Details header="Example 1 - specific or below">

If you have only these two records on your domain, `A` and `TXT`:
If you have only these two records on your domain:

| Type | Name | Content |
| ----- | ------------------------- | ------------- |
| `A` | `*.example.com` | `192.0.2.3` |
| `TXT` | `subdomain1.example.com ` | `<some_text>` |
| `A` | `*` | `192.0.2.1` |
| `TXT` | `abc` | `<some_text>` |

The `A` wildcard record will be used for queries going to any subdomain of `example.com` except `subdomain1.example.com` or anything below that specific label (`deeper.label.subdomain1.example.com`).
The `A` wildcard record will be used for queries going to any subdomain of `example.com` except `abc.example.com` or anything below that specific label (`123.abc.example.com` or `deeper.label.abc.example.com`, and so on).

The wildcard will still be used for deeper labels that are not below the specific record on `subdomain1.example.com` — for example, `deeper.label.subdomain2.example.com`.
The wildcard will still be used for deeper labels that are not below the specific record on `abc.example.com` — for example, `deeper.label.xyz.example.com`.

</Details>

<Details header="Example 2 - implicit parent">

If you have only these two records on your domain:

| Type | Name | Content |
| ----- | ------------------------- | ------------- |
| `A` | `*` | `192.0.2.1` |
| `TXT` | `123.abc` | `<some_text>` |

In this example, `123.abc.example.com` is a descendant of `abc.example.com`, and `abc.example.com` has no records associated with it. The behavior will depend on the type of nameservers you are using:

- Standard nameservers: The wildcard `*.example.com` will still apply to `abc.example.com`.
- [Advanced nameservers](/dns/foundation-dns/setup/)[^1]: In compliance with [RFC 4592](https://www.rfc-editor.org/rfc/rfc4592.html), the wildcard `*.example.com` will not apply to `abc.example.com`.

</Details>

## Availability

Customers on all plans can create and proxy wildcard DNS records.
Expand All @@ -81,3 +100,5 @@ If you are using a [partial (CNAME) setup](/dns/zone-setups/partial-setup/) for
## Additional information

For more information on wildcard records — as well as more details about their limitations — refer to the [introductory blog post](https://blog.cloudflare.com/wildcard-proxy-for-everyone/).

[^1]: An opt-in configuration available for Enterprise customers.
Loading