Is there a difference between @ and * when using BIND?

Question

When configuring a BIND DNS zone, I often wonder why there exists both @ and * to specify an alias for the zone name. Is there a difference between the two?

Answer 1

@ is translated to be the domain name of the zone it is in reference too. This is this were used in the zone file for example.com then @ would equal 'example.com'. On the other hand * is a wildcard meaning anything.

Here is an example of how I use these two symbols in a zone file:

; SOA Record
EXAMPLE.NET.    3600    IN  SOA ns1.example.com.    dns.example.net. (
                2010031000
                28800
                7200
                604800
                86400
                )

; A Records
@   3600    IN  A   192.168.1.212
@   3600    IN  A   192.168.1.214

; CNAME Records
www 3600    IN  CNAME   @
*   3600    IN  CNAME   @

; NS Records
@   3600    IN  NS  ns1.example.com
@   3600    IN  NS  ns2.example.com

In this example I'm defining the zone for EXAMPLE.NET using EXAMPLE.COM's DNS servers. I have 2 IP addresses which I assign to A records for domain so EXAMPLE.NET points to both 192.168.1.212 and 192.168.1.214. I then define a couple of CNAME records, www and the magical * which both point to @ or as it's interpreted EXAMPLE.NET. There are also the NS records using the @ symbol instead of having to type out EXAMPLE.NET.

So you could actually translate this zone file to be:

; SOA Record
EXAMPLE.NET.    3600    IN  SOA ns1.example.com.    dns.example.net. (
                2010031000
                28800
                7200
                604800
                86400
                )

; A Records
EXAMPLE.NET.    3600    IN  A   192.168.1.212
EXAMPLE.NET.    3600    IN  A   192.168.1.214

; CNAME Records
www 3600    IN  CNAME   EXAMPLE.NET.
*   3600    IN  CNAME   EXAMPLE.NET.

; NS Records
EXAMPLE.NET.    3600    IN  NS  ns1.example.com
EXAMPLE.NET.    3600    IN  NS  ns2.example.com

Both versions are identical. The @ simply becomes EXAMPLE.NET and the * means anything you could think of. By using the * wildcard you could setup a webserver for a domain and then configure multiple virtual hosts under that domain without having to modify DNS again. host1.example.net, blah.example.net and doiexist.example.net will all point to the same location even though they are not specifically stated in the zone file because of the * wildcard.

Answer 2

In addition to what Bill Weiss said i would like to point out that * means "all possible subdomains/labels except those already present", this means that i can have

$ORIGIN EXAMPLE.NET.
a IN A 1.2.3.4
b IN A 4.3.2.1
* IN A 8.8.8.8

and a.EXAMPLE.NET will return 1.2.3.4 just like c.EXAMPLE.NET will 8.8.8.8

Also a.a.a.c.EXAMPLE.NET will return 8.8.8.8 as well which is just what makes wildcard records a bit messy. You can potentially use up all the cache of an recursive nameserver by iterating over these names.

Answer 3

* isn't an alias for the zone name. It means "all subdomains".

Answer 4

Think of @ as a macro which is expanded during the parsing of the zone files while * is an operator which "globs" (matches) anything which hasn't matched any of the normal entries.

The * entry allows one to configure a DNS to return the specified records for queries which would otherwise get an "NXDOMAIN" (non-existent) response.

Answer 5

"@" expands to the current $ORIGIN, per RFC 1035. I've seen this most often in the SOA record at the top of zone file.

I've never seen '*' used for anything but to match anything not previously matched in RR entries (aka "wildcard" entries).