Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When configuring a BIND DNS zone, I often wonder why there exists both @ and * to specify an alias for the zone name. Is there a difference between the two?

share|improve this question

5 Answers 5

up vote 9 down vote accepted

@ is translated to be the domain name of the zone it is in reference too. This is this were used in the zone file for example.com then @ would equal 'example.com'. On the other hand * is a wildcard meaning anything.

Here is an example of how I use these two symbols in a zone file:

; SOA Record
EXAMPLE.NET.    3600    IN  SOA ns1.example.com.    dns.example.net. (
                2010031000
                28800
                7200
                604800
                86400
                )

; A Records
@   3600    IN  A   192.168.1.212
@   3600    IN  A   192.168.1.214

; CNAME Records
www 3600    IN  CNAME   @
*   3600    IN  CNAME   @

; NS Records
@   3600    IN  NS  ns1.example.com
@   3600    IN  NS  ns2.example.com

In this example I'm defining the zone for EXAMPLE.NET using EXAMPLE.COM's DNS servers. I have 2 IP addresses which I assign to A records for domain so EXAMPLE.NET points to both 192.168.1.212 and 192.168.1.214. I then define a couple of CNAME records, www and the magical * which both point to @ or as it's interpreted EXAMPLE.NET. There are also the NS records using the @ symbol instead of having to type out EXAMPLE.NET.

So you could actually translate this zone file to be:

; SOA Record
EXAMPLE.NET.    3600    IN  SOA ns1.example.com.    dns.example.net. (
                2010031000
                28800
                7200
                604800
                86400
                )

; A Records
EXAMPLE.NET.    3600    IN  A   192.168.1.212
EXAMPLE.NET.    3600    IN  A   192.168.1.214

; CNAME Records
www 3600    IN  CNAME   EXAMPLE.NET.
*   3600    IN  CNAME   EXAMPLE.NET.

; NS Records
EXAMPLE.NET.    3600    IN  NS  ns1.example.com
EXAMPLE.NET.    3600    IN  NS  ns2.example.com

Both versions are identical. The @ simply becomes EXAMPLE.NET and the * means anything you could think of. By using the * wildcard you could setup a webserver for a domain and then configure multiple virtual hosts under that domain without having to modify DNS again. host1.example.net, blah.example.net and doiexist.example.net will all point to the same location even though they are not specifically stated in the zone file because of the * wildcard.

share|improve this answer
2  
Actually, '@' is expanded to the current $ORIGIN, as it can be redefined in a zone file. RFC 1035 + zytrax.com/books/dns/ch8/origin.html –  quadruplebucky Mar 15 '10 at 18:15
    
You're quite right quadruplebucky... $ORIGIN however unless specified defaults to the domain of the zone. Quite handy if you have EXAMPLE.COM, EXAMPLE.NET and EXAMPLE.ORG that you want to have the same entries without having to maintain 3 zone files. –  Jeremy Bouse Mar 16 '10 at 2:01

In addition to what Bill Weiss said i would like to point out that * means "all possible subdomains/labels except those already present", this means that i can have

$ORIGIN EXAMPLE.NET.
a IN A 1.2.3.4
b IN A 4.3.2.1
* IN A 8.8.8.8

and a.EXAMPLE.NET will return 1.2.3.4 just like c.EXAMPLE.NET will 8.8.8.8

Also a.a.a.c.EXAMPLE.NET will return 8.8.8.8 as well which is just what makes wildcard records a bit messy. You can potentially use up all the cache of an recursive nameserver by iterating over these names.

share|improve this answer

Think of @ as a macro which is expanded during the parsing of the zone files while * is an operator which "globs" (matches) anything which hasn't matched any of the normal entries.

The * entry allows one to configure a DNS to return the specified records for queries which would otherwise get an "NXDOMAIN" (non-existent) response.

share|improve this answer

"@" expands to the current $ORIGIN, per RFC 1035. I've seen this most often in the SOA record at the top of zone file.

I've never seen '*' used for anything but to match anything not previously matched in RR entries (aka "wildcard" entries).

share|improve this answer

* isn't an alias for the zone name. It means "all subdomains".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.