Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It seems there's no way to tell bind that * should resolve to eg., while * resolves to Is there any workaround? Can some names eg. resolve with an external program? Or should I change bind to eg. PowerDNS?

I'm trying to avoid buying another SSL wildcard cert. (With wildcard certs, such as *, it's not possible to allow dots in the * part.)

Specifying all *-foo or *-bar names in the zone file is not an option, since I need to be able to create both type of addresses on the fly.

share|improve this question
Is there no way to add the domains to the zone on the fly as well? I have never seen partial wildcards used with bind. I cannot say for sure that it's not possible though. – David Houde May 3 '13 at 10:21
@DavidHoude: I'm afraid that adding on the fly is not an option, since any query that predates the addition will "pollute" name servers with an invalid answer. That creates problems that are quite rare but a bit nasty to resolve. (Of course time will fix the problem.) – tuomassalo May 3 '13 at 10:23
Does $GENERATE help you? – Celada May 3 '13 at 16:07
@DavidHoude - you could use dynamic update, but as the original poster points out you then run into the situation where a caching resolver may have cached a negative response before the record was added. To try and mitigate that you could lower the negative caching ttl to a very low value but not every resolver honors ttls scrupulously and some impose a practical minimum so results could be frustratingly variable. – Michael McNally May 4 '13 at 6:19
@Celada: the * part can be any [a-z] string (with length restrictions, of course). So, in my case $GENERATE does not help. Thanks for the tip though - might become handy for someone else who finds this page. – tuomassalo May 6 '13 at 6:54
up vote 7 down vote accepted

The reason why it doesn't work is because it's not defined behavior within the RFCs. It must be implemented as an extension of the software you're using. RFC4592 cements the definition of a wildcard record pretty firmly:

2.1.1. Wildcard Domain Name and Asterisk Label

A "wildcard domain name" is defined by having its initial (i.e.,
leftmost or least significant) label be, in binary format:

  0000 0001 0010 1010 (binary) = 0x01 0x2a (hexadecimal)

Note the term label here. A label is the dot separated entity. If you have anything other than the asterisk in the label, it's not a wildcard.

You're kinda stuck here. Working within DNS, you need that dot that you're trying to avoid. Everything else is extensions to the server software and implementation specific.

share|improve this answer
Nicely answered. – Michael McNally May 4 '13 at 6:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.