Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to wrap my head around the wonderful world on DNS.

I have created a zone file for which contains:

@     A
*     A

However I am also setting up my local DNS, which I have created a separate zone file for containing the following:

machine1     A
machine2     A

When I dig it returns A record, great.

Sadly, returns, as does

I'm not sure of the best way to prevent this. If I add the following to the empty A records are returned for the above 2 examples as is the behaviour I desire:

@     A
*     A

I want to use the wildcard EXCEPT anything in the subdomain which I do not want to give a response unless specified. Essentially I need a wild card with one exclusion.

Is this allowed? Is this best practice, or am I doing things terribly wrong? I'm using PowerDNS with BIND backend.

Thanks for your thoughts!

share|improve this question

Firstly, your comment to Chris S above clarifies (indeed, modifies) your original question considerably, and I hope you'll forgive me editing it into your original question.

Secondly, null records aren't permitted, as others have noted.

Thirdly, I think the way to do what you want is to declare to be a proper subdomain:

local                       IN      NS
local                       IN      NS

listing the same two nameservers as you currently run for (note: I don't know PowerDNS,so my entries above are in BIND format). Then on those nameservers (which I presume is this nameserver) you declare a zonefile for which contains only the hosts you want to resolve, and no wildcard record.

So when people look up, assuming that's not listed, it'll match the existing wildcard record, and return (or whatever). But when people look up, the nameserver records for will be returned and a further recursion will take place, with your nameserver now looking at the zonefile for, and saying (in the absence of a specific record for foo and a wildcard in "no, there is no such record".

share|improve this answer
I tried that, however the subdomain itself is on the same name server, so it just seems to redirect back to itself. Here is my bind-style configuration of zones: <pre>zone "" IN { type master; file ""; }; zone "" IN { type master; file ""; };</pre> Given blank A records seem to be working (despite being technically invalid, is it worth worrying about?), especially given that it's only for local dns records which will be irrelevant to anyone querying externally. – John Dec 21 '10 at 17:32

It would be useful to know exactly what responses you are after. The first two lines quoted in your question set the default response for the domain, and unmatched record response as well. Hence will be serviced by the "@" record, and will be serviced by the "*" record. They aren't necessary, you can get rid of both. Setting them to blank values is an invalid configuration (on most systems).

share|improve this answer
Well, I do have additional subdomains, I just condensed them out here. I want to use the wildcard EXCEPT anything in the subdomain which I do not want to give a response unless specified. Essentially I need a wild card with one exclusion. Thanks for your input. – John Dec 21 '10 at 16:17

I can't think of a way to "null" an entry. Empty A records are not permitted.

Perhaps * A would prevent override of the entries? It sounds like PowerDNS is misbehaving from spec. Having domain defined should prevent the wildcard from stomping on anything in that domain. Can you post full zone files? That would resolve a number of small questions.

share|improve this answer
Yes, searching the net, I can't find any information at all pertaining to 'null'-ing dns records, which I'm incredibly surprised about. I tried * and it made no difference, it's surely technically identical to just * and still falls under it. – John Dec 21 '10 at 17:35
On posting full zone files, they've changed so much as I've tried different configurations I wouldn't know what to put! I think I've provided the essentials, are there any specific records? – John Dec 21 '10 at 17:36
No, nothing specific. I was seeking to find something that would be answered by a question which I may not ask. One curiosity is whether that wildcard record is also copied in the file. Can you try putting the wildcard entry at the bottom of the zone file? The placement shouldn't matter, but I don't have a lot of ideas for that one right now. I'm pretty sure BIND server doesn't behave in this manner, so I'm included to blame PowerDNS. – Jeff Ferland Dec 21 '10 at 17:55

You should look at the specific behavior of the server you are running, because this feature has not been implemented consistently:

To quote from RFC 4592, many DNS implementations diverge, in different ways, from the original definition of wildcards.

Wildcards in practice

What you want the wildcard entry to do is correct, as I understand the definition of the wildcard usage (better to think of it as a default value of last resort). I will try to find time to read the clarifying RFC and update here...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.