Here's what I suspect is happening but can't prove it on my own systems since I don't want to stick a wildcard record on my DNS servers.
This somewhat works, except that when I run nslookup www.domain.com I
get this response:
This is because your nslookup query is technically an unqualified name.
You can test this by doing an
nslookup www.domain.com. (note the trailing period/dot at the end that "qualifies" it) and see if the return is valid now.
EDIT: yeah this seams to be the case...because your wildcard entry is invalidating the normal
NXDOMAIN response nslookup normally returns in this case. Since nslookup always appends the suffix if the lookup doesn't have the trailing period.
For instance, here's one on my computer:
> set debug=true
opcode = QUERY, id = 2, rcode = NXDOMAIN
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0
www.yahoo.com.mdmarra.local, type = A, class = IN
Notice how it returned NXDOMAIN for www.yahoo.com.mdmarra.local. It will then go on to query just www.yahoo.com using forwarders. Since you have the wildcard entry it thinks your query is valid based on the wildcard.