Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To make any otherwise-unassigned first-level subdomain resolve to one Linux VPS, create a wildcard owner such as *.example.com. in the authoritative BIND9 zone for example.com. A wildcard is a DNS label, not a shell pattern: it can answer app.example.com, but it does not make the bare example.com name match, and an existing record such as www.example.com takes precedence.
The reliable workflow is to delegate the domain to your nameserver, configure a primary BIND zone, add explicit records before the wildcard, raise the SOA serial, validate the configuration and zone, reload BIND, and query the authoritative VPS directly. The examples below use Debian/Ubuntu-style paths; package names, service names and file locations can differ on other distributions.
Recommended Free Tools
What a BIND9 wildcard actually matches
DNS names are made of labels separated by dots. In a zone for example.com., the owner *.example.com. is a wildcard at the leftmost label. It supplies an answer only when the queried name has no closer existing node in the zone.
| Query | What happens with the example configuration |
|---|---|
app.example.com. |
The wildcard can provide the configured A or AAAA answer. |
www.example.com. |
An explicit www record is used; the wildcard does not replace it. |
example.com. |
The apex needs its own record, such as @ IN A; the wildcard does not cover it. |
one.two.example.com. |
Do not assume a single wildcard is a recursive pattern for arbitrary depth. Matching is evaluated at DNS label boundaries and closer nodes or delegations can change the result. |
| A name below a delegated child zone | The child zone becomes authoritative for that branch, so the parent wildcard is not the answer for names inside it. |
Wildcard processing is also why an apparently valid record can seem to be ignored. BIND checks for an existing node at the relevant name before synthesizing an answer from the wildcard. The BIND 9 Administrator Reference Manual describes non-terminal wildcard mistakes as “almost always the result of a failure to understand the wildcard matching algorithm (RFC 4592).”
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Prerequisites before editing BIND
- A registered domain: You need control of the registrar account for the domain you will serve.
- A stable public address: Use the VPS public IPv4 address and, if you publish IPv6, a stable public IPv6 address. Replace the documentation address in the examples with your real address.
- Authoritative delegation: At the registrar, set the domain’s nameserver hostnames to the servers that will answer for the zone. If a nameserver hostname is inside the delegated domain, create the required registrar glue record so resolvers can find its address.
- Network access: Permit both UDP and TCP port 53 in the VPS firewall and in the hosting provider’s security group. Authoritative DNS uses both transports; allowing only UDP is not sufficient.
- Administrative access: You must be able to read and edit BIND configuration and zone files with an account that can run the validation and reload commands.
Delegation and firewall checks are independent of the zone-file syntax. A perfect zone will still appear broken if the registrar points at different nameservers, glue is missing, or port 53 is filtered.
Choose the operating model first
A wildcard is only one part of the design. Decide how records will be maintained and how much resilience you need before putting the VPS into production.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Decision | Option 1 | Option 2 | Operational trade-off |
|---|---|---|---|
| How names are answered | One wildcard A/AAAA target | Explicit records for each service | A wildcard is quick for many similarly routed names. Explicit records make exceptions, migrations and service-specific targets unambiguous. |
| How changes are made | Manually edited zone file | Authenticated dynamic updates | Static files are simple and auditable. Dynamic updates suit automation but require an update policy and authenticated identities. |
| Authority layout | One primary on the VPS | Primary plus secondary on separate networks | A single server is simpler but is a single failure point. A secondary improves availability if it is independently connected and maintained. |
| Cache lifetime | Short TTL | Long TTL | Short TTLs let changes be observed sooner but increase query traffic. Long TTLs reduce repeat queries but keep old answers cached longer. |
These are operational choices rather than universal settings. A development wildcard may be comfortable on one VPS, while a public service should normally have independently reachable authoritative servers and a documented change process.
Declare the primary zone
BIND must be told which domain it serves and which file contains that zone’s data. In a Debian/Ubuntu-style installation, add a zone declaration to /etc/bind/named.conf.local:
zone "example.com" {
type primary;
file "/etc/bind/zones/db.example.com";
allow-query { any; };
allow-transfer { none; };
};type primary is also called master in BIND documentation. The file setting points BIND at the primary zone data. The example permits public queries and denies transfers because no secondary is configured. If you later operate a secondary, replace the transfer policy with a narrowly scoped rule for that server and authenticate transfers where appropriate.
Create the directory used by the file setting if your distribution has not already created it, and set ownership and permissions so the BIND service can read the zone while unprivileged users cannot modify it accidentally. Distribution defaults vary, so preserve the permissions model supplied by your package.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Write the zone file and place exceptions first
Create /etc/bind/zones/db.example.com with an SOA, nameserver, apex address, explicit exceptions and the wildcard:
$TTL 300
@ IN SOA ns1.example.com. hostmaster.example.com. (
2026101501 ; serial: YYYYMMDDnn
3600 ; refresh
900 ; retry
1209600 ; expire
300 ; negative cache TTL
)
IN NS ns1.example.com.
ns1 IN A 203.0.113.10
@ IN A 203.0.113.10
www IN A 203.0.113.10
* IN A 203.0.113.10How each record is used
$TTL 300sets a five-minute default TTL for records that do not specify another value. It is a starting point, not a promise that every resolver will discard an answer at exactly five minutes.- The SOA identifies the primary nameserver and the mailbox for the zone administrator. In DNS notation, the mailbox uses a dot instead of an
@;hostmaster.example.com.represents the administrator address for this example. - The serial
2026101501follows a YYYYMMDDnn pattern. Increase it for every manual edit, including a change that only adjusts a wildcard target, so secondaries and caches can recognize newer data. - The NS record delegates authority for the zone to
ns1.example.com.. The correspondingns1address record is needed when that nameserver is inside the same domain. - The
@A record answers the zone apex. It is separate from the wildcard and is required if the bare domain should reach the VPS. - The explicit
wwwrecord is an exception. It remains authoritative even though the wildcard could otherwise supply an answer for that name. - The
*owner is the wildcard. It can synthesize an A answer for an unmatched name such asapp.example.com..
Use fully qualified names with a trailing dot when the name must not be expanded relative to the zone. A missing trailing dot can turn an intended target into a name beneath the current zone.
Add service records explicitly
Do not rely on the A wildcard for services that need different record types or names. Add and test explicit AAAA, CNAME, MX, TXT and ACME challenge records when those services are used. Mail exchangers, certificate-validation names and service discovery records often have targets or values that should not inherit the web VPS address. Keep those records above the wildcard in the file so the intended exceptions are easy to audit.
Validate before reloading
Never reload an edited zone blindly. Run both the global configuration check and the zone-specific check as an account permitted to read the files:
- Check BIND configuration syntax:
sudo named-checkconf - Check the zone’s names, record syntax and integrity:
sudo named-checkzone example.com /etc/bind/zones/db.example.com - Proceed only when the checks report no errors.
named-checkzonereturns status 0 when no errors are detected and status 1 when errors are found. - Reload the individual zone:
sudo rndc reload example.com
or, where the distribution supports it, reload the service:sudo systemctl reload bind9
BIND performs post-load integrity checks for primary zones, but named-checkzone is still the useful pre-change gate, including checks involving out-of-zone names and glue. If a zone is generated or compiled, named-compilezone can validate syntax and integrity and write a specified output format. Do not run it on untrusted zone text: its $INCLUDE processing can read files accessible to the invoking user.
If validation fails, correct the reported line, rerun the check and only then reload. If the reload command itself fails, inspect the service log rather than assuming that the old zone was replaced.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Verify the wildcard from the authoritative VPS
Query the server’s public address directly so a recursive resolver’s cached answer cannot hide an error:
dig @203.0.113.10 app.example.com A +noall +answer
dig @203.0.113.10 www.example.com A +noall +answer
dig @203.0.113.10 example.com SOA +noall +answerUse a repeatable test set after every change:
- Query at least two random, otherwise-unused labels, for example
alpha.example.comandbeta.example.com. Both should receive the wildcard address and the expected TTL. - Query an explicit exception such as
www.example.com. It should return its own record rather than an unintended wildcard value. - Query the apex with an SOA or A request to confirm that the zone itself is loaded and that the apex record is independent of wildcard behavior.
- Query a nonexistent deeper name and inspect whether a closer node or delegation explains the result instead of assuming the wildcard is recursive.
- Repeat testing from an external network over both UDP and TCP. A local test can succeed while a provider firewall or security group blocks public traffic.
For a broader delegation check, run dig +trace from a separate host and compare the nameservers reached by the trace with the VPS that you queried directly.
Why a wildcard appears not to work
An explicit node wins
If www.example.com., a child delegation or another closer node exists, BIND does not use the parent wildcard for that name. Inspect the complete zone and any delegated child zones before changing the wildcard.
The query is for the apex
The apex is not an unmatched child label. Give it its own A and/or AAAA record if the bare domain should resolve.
The name is deeper than the wildcard boundary
*.example.com. is positioned at one label below the zone. It is not a general pattern that automatically handles every arbitrary-depth name. If a deeper namespace is required, model that namespace with the appropriate records or child zone.
The wildcard is non-terminal
A wildcard that has data below it can be surprising and is commonly a sign that the matching algorithm was misunderstood. BIND’s check-wildcard option checks for non-terminal wildcards. Treat warnings as a design review: simplify the record layout or create the intended child zone explicitly.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
The edited file was never loaded
Verify that the SOA serial increased, that the edited path matches the file setting, and that the reload targeted the correct zone. Query the authoritative address again rather than a public recursive resolver while diagnosing.
Delegation or transport is wrong
A registrar may still delegate different nameservers, glue may be absent for an in-domain nameserver, or UDP/TCP 53 may be blocked. Check registrar delegation, VPS firewall rules and provider security-group rules from outside the server.
The server returns SERVFAIL
SERVFAIL commonly indicates a delegation, DNSSEC, transport or load problem rather than a simple wildcard typo. Review journalctl -u bind9, BIND’s configured logs and the output of dig +trace from another host. A zone that passes syntax validation can still fail to serve if the service cannot read it, cannot bind to the address or is serving stale state.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSecure an authoritative-only VPS
Restrict zone transfers
Leave allow-transfer closed when there is no secondary. If you add one, permit only the secondary’s addresses and use authenticated transfers where appropriate. Never expose unrestricted transfers of a public zone when they are not needed.
Use authenticated dynamic updates
For automation, BIND exposes update-policy and related controls. An update policy can authorize identities using TSIG or SIG(0), allowing a deployment system to change only the names it needs instead of granting broad file access. Define the policy deliberately, protect the keys, and keep manual edits and automated updates from competing over the same file without an agreed workflow.
Do not provide open recursion by accident
An authoritative public VPS should not become an open recursive resolver. Configure recursion and query ACLs deliberately for the role you intend. Public authoritative queries can be allowed while recursive service remains disabled or restricted to trusted networks, according to your distribution’s BIND configuration.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Protect and monitor the data
- Keep a backup of every known-good zone file and its corresponding configuration.
- Increment the SOA serial for every manual change and record what changed.
- Monitor authoritative answers from outside the VPS, including the wildcard, explicit exceptions and the apex.
- Watch service logs after reloads and during delegation changes.
- Review firewall and provider security-group rules whenever the VPS address, network interface or hosting arrangement changes.
TTL, serials and change management
The sample default TTL of 300 seconds is intentionally short for an example. A short TTL can reduce the time that old addresses remain cached during a migration, but it may increase repeat queries. A longer TTL can reduce query volume and improve cache efficiency while making an emergency address change take longer to appear everywhere. Pick a value based on how often records change and how quickly you must recover; do not treat one TTL as universally correct.
The SOA serial is a separate mechanism from TTL. TTL controls how long recursive resolvers may reuse an answer. The serial tells secondary servers that the zone data has changed. Raise the serial even when the edited record is not the wildcard itself, and ensure the value increases monotonically if you use a date-and-counter format.
Single VPS or primary/secondary DNS
A single VPS can be appropriate for a low-risk project, an internal environment or a temporary deployment, provided the registrar, firewall and monitoring are correct. It has one network path, one service state and one maintenance window.
A primary/secondary arrangement places a copy of the zone on another authoritative server, ideally on a separate network or provider. The primary remains the editing authority; the secondary receives transfers and answers if the primary is unavailable. BIND supports primary and secondary zone types. Configure transfer permissions narrowly, authenticate transfers where appropriate and test that the secondary actually serves the same wildcard and exception records before relying on it.
Redundancy does not correct a bad delegation or invalid zone. Keep the same validation, serial-increment and external-query process for both designs.
Quick Recap
Practical deployment checklist
- Domain delegation points to the intended authoritative nameservers.
- Glue exists for any nameserver hostname inside the delegated domain.
- The VPS has stable public IPv4 and, when used, IPv6 addresses.
- UDP and TCP port 53 are open in both the host firewall and provider security group.
- The
zonestatement names the correct domain and file. - The SOA, NS, nameserver address, apex record and explicit service exceptions are present.
- The wildcard is written with
*as the leftmost owner label. - The SOA serial was incremented after the edit.
named-checkconfandnamed-checkzonecompleted successfully.- BIND was reloaded only after validation.
- Direct
digqueries confirm random labels, exceptions and the apex. - Transfers, dynamic updates, recursion and query ACLs are restricted to the intended role.
- Zone backups and outside monitoring are in place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
