iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A wildcard subdomain fails for one of two broad reasons: DNS never returns an address, or DNS returns an address but the proxy, server, firewall, or certificate cannot handle that hostname. Start with the authoritative DNS provider, verify the wildcard label and target, and query the exact hostname. Only after DNS is correct should you troubleshoot HTTP, routing, or TLS.
For tenant.example.com, the usual record is *.example.com. For dev.blog.example.com, you need a wildcard at the appropriate deeper level, such as *.blog.example.com. Existing specific records take precedence over a wildcard, so two apparently similar subdomains can behave differently.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Understand what a wildcard DNS record actually does
A wildcard is a fallback rule in a DNS zone, not a universal command to answer every name. A record such as *.example.com can supply an answer for an otherwise-unconfigured first-level name, for example tenant.example.com. It does not replace an exact record, does not automatically create the apex record example.com, and does not match every possible depth below the zone.
Wildcard labels match one level
| Hostname being requested | Wildcard that can match it | Why |
|---|---|---|
tenant.example.com |
*.example.com |
The asterisk replaces the single label immediately below example.com. |
dev.blog.example.com |
*.blog.example.com |
The wildcard is placed below the blog label, at the level being generated. |
dev.blog.example.com |
*.example.com |
Does not match this deeper name. |
example.com |
Not supplied by *.example.com |
The zone apex needs its own A, AAAA, or other appropriate record. |
An asterisk inside a label is literal text. A name such as tenant.*.example.com is not a wildcard pattern; it asks DNS for a label that literally contains an asterisk. Put the asterisk in the complete left-most label of the record name, for example * when the dashboard already displays the zone name, or *.www for names below www.example.com.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Specific records override the wildcard
DNS follows the more-specific record when one exists. Cloudflare summarizes the rule as: "Specific DNS records take precedence over wildcard records." An exact A, AAAA, CNAME, TXT-related delegation, or other record at the requested name can therefore prevent the wildcard from being used. A delegation or a closer name in the zone can have the same practical effect. This is why alpha.example.com may work through the wildcard while beta.example.com fails after someone added a separate record or delegation for beta.
Classify the failure before changing records
Write down the complete failing hostname and the precise error. The first visible browser message often tells you which layer to inspect.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Observed symptom | What it usually means | Start here |
|---|---|---|
NXDOMAIN or DNS_PROBE_FINISHED_NXDOMAIN |
The resolver found no applicable DNS record for that name. | Authoritative zone, delegation, wildcard spelling, overrides, and cache. |
SERVFAIL |
The resolver could not obtain a valid answer, often because of DNSSEC, an unreachable authoritative server, or a malformed zone. | Authoritative responses, DNSSEC status, and nameserver health. |
| DNS returns an address but the browser times out | The address is reachable only in theory; routing, a firewall, a security group, or an unavailable listener may be blocking it. | Proxy path, ports 80/443, origin routing, and both A and AAAA targets. |
| Connection refused | A host answered but no process accepted the requested port, or a firewall actively rejected it. | Web-server listeners, container or load-balancer ports, and firewall rules. |
| HTTP 400, 404, 421, 502, or 503 | The request reached a proxy or origin, but hostname routing or upstream health is wrong. | Host header, virtual host, proxy-to-origin settings, and application routes. |
| Certificate name warning or TLS handshake failure | The certificate presented does not cover the hostname, the wrong certificate is selected by SNI, or the TLS path is misconfigured. | Certificate names, proxy status, SNI, and origin TLS settings. |
Use this order of operations
Changing several DNS records at once makes diagnosis harder. Follow the sequence below and record each result.
1. Record the exact name and expected destination
Write the full hostname, such as tenant.example.com or dev.blog.example.com. Note whether it should point to an origin IP through an A or AAAA record, or to another hostname through a CNAME. Also note whether the service is intended to be behind a reverse proxy or reached directly. A wildcard cannot compensate for an incorrect origin address.
2. Confirm which provider is authoritative
Public DNS uses the nameservers delegated for the domain, not whichever dashboard you last opened. At a terminal, run:
dig NS example.com +shortCompare the returned nameservers with the provider where you created the wildcard. If the registrar delegates the zone to a different provider, edits made elsewhere cannot answer public queries. For a newly activated domain, inspect the apex records and active subdomains at the delegated provider; an incomplete or incorrect delegation commonly produces NXDOMAIN.
Also check for split-horizon DNS. A corporate network, VPN, or local resolver may serve an internal view of the zone while public resolvers serve another. Test from a normal external connection as well as from the network where the failure occurs.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Create the wildcard at the correct label
Most DNS dashboards have a path similar to DNS or DNS Records, followed by Add record. Select the record type required by the design:
- Use an A record when the destination is an IPv4 address.
- Use an AAAA record when the destination is an IPv6 address that is reachable and configured for the service.
- Use a CNAME when every generated name should follow another hostname.
For first-level tenant names, enter * in a dashboard that appends example.com, producing *.example.com. For names below www, enter *.www, producing *.www.example.com. Do not enter tenant.* or put the asterisk in the middle of a label. Check the final fully qualified name shown by the dashboard before saving.
A wildcard CNAME still follows normal CNAME rules: it cannot share the same owner name with other data, and its target must itself resolve. If the target is misspelled or its zone is unavailable, the wildcard can appear present while requests still fail.
Recommended Free Tools
4. Look for a record that prevents wildcard use
List records for the exact hostname and its parent labels. Look for an old A, AAAA, CNAME, or delegation created during a migration. An exact record wins even when it points to the wrong address; the wildcard will not repair it. A deeper hostname can also be affected by a closer record or delegation, so inspect names between the queried host and the zone apex.
Compare a working generated name with a failing one. Differences often reveal a typo, an explicit record, a different parent level, or a separate IPv6 answer. Remove or correct the conflicting record only after confirming that no other service depends on it.
5. Query the authoritative answer and a recursive answer
Query the exact name rather than only the zone apex:
dig tenant.example.com Adig tenant.example.com AAAAdig tenant.example.com CNAME
To follow delegation from the root, use:
dig +trace tenant.example.comA trace helps show which nameserver is authoritative and where the chain stops. Once you know an authoritative nameserver, query it directly using the server name returned by the NS lookup:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
dig tenant.example.com A @authoritative-nameserverThen compare a public recursive resolver:
dig tenant.example.com A @8.8.8.8dig tenant.example.com A @1.1.1.1
Replace the resolver addresses with resolvers you trust if those services are unavailable on your network. The important comparison is authoritative versus recursive, not a particular brand of resolver.
- If the authoritative server returns the wrong address or NXDOMAIN, fix the zone, label, delegation, or target IP.
- If the authoritative answer is correct but a recursive resolver is old, wait for the record’s TTL and any negative-cache period to expire.
- If answers differ between networks, investigate split-horizon DNS, VPN policies, filtering, or a stale upstream cache.
6. Allow for positive and negative caching
Resolvers cache successful answers for the record’s TTL. They also cache negative answers such as NXDOMAIN for a period derived from the zone’s SOA settings. Deleting an incorrect record does not guarantee that every resolver will immediately forget the old result. After a change, test with an authoritative query first, then re-test through more than one recursive resolver and from a private browser window.
Do not repeatedly edit the record while caches are still valid. Note the time of the change and the TTL shown by dig; use that information to decide when a new test is meaningful.
7. Verify the returned address and record chain
Confirm that the A or AAAA value belongs to the intended origin and that a CNAME chain ends at a name with usable A or AAAA records. Check both address families. An incorrect AAAA record can make some clients try IPv6 first and fail even though the A record works over IPv4. Remove the AAAA record if the service is not actually listening and routed over IPv6, or configure the IPv6 path correctly.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →When DNS resolves but the site is still unreachable
A DNS answer proves only that a name mapped to data. It does not prove that a web server accepts the request, that a reverse proxy can reach the origin, or that the certificate is correct.
Check proxy status and the intended traffic path
Managed DNS platforms often offer a proxied mode and a DNS-only mode. In DNS-only mode, the client connects to the origin address and the origin must accept HTTPS and present a suitable certificate. In proxied mode, the client connects to the provider’s edge; the provider then connects to the origin according to its configuration. The public DNS answer in proxied mode may therefore show edge addresses rather than your origin IP, which is expected.
Cloudflare documents that it can serve a certificate for a DNS record only when the record is set to Proxied; with DNS-only, the origin is responsible for TLS. Apply that distinction to whichever proxy service you use: verify who terminates the client TLS session and who must authenticate the origin connection.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Test the origin independently
From a network that can reach the server, test the expected ports and hostname:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchcurl -I http://tenant.example.comcurl -Iv https://tenant.example.com
For a direct origin test where the public name resolves to a proxy, use a temporary hosts-file entry or the curl --resolve option with the origin address:
curl -Iv --resolve tenant.example.com:443:203.0.113.10 https://tenant.example.com/The address above is an example documentation IP; substitute the actual origin address. This test preserves the hostname and SNI while bypassing public DNS. A successful direct test but a failed proxied test points to proxy reachability, allow-listing, or proxy TLS settings. A failed direct test points to the server, network, or certificate itself.
Confirm listener, firewall, and routing settings
- Ensure the web server or load balancer listens on the address and port being used, not only on localhost.
- Open TCP 80 and 443 where the design requires them, including cloud security groups, host firewalls, and network ACLs.
- Check NAT, port-forwarding, container publishing, and load-balancer target health.
- Allow the proxy’s documented source ranges if the origin is restricted to proxy traffic, while avoiding an unrestricted public origin when that is not intended.
- Verify that the virtual host or application router recognizes the complete hostname and does not send every unknown host to a default site.
A 502 or 503 from a proxy generally means the edge reached the proxy layer but could not obtain a healthy origin response. Inspect origin logs at the time of a request; the Host header and SNI name should match the generated subdomain.
Fix HTTPS and certificate coverage separately
Know what a wildcard certificate covers
| Certificate name | Covers | Does not automatically cover |
|---|---|---|
*.example.com |
tenant.example.com, shop.example.com |
example.com or dev.blog.example.com |
*.blog.example.com |
dev.blog.example.com |
blog.example.com or dev.team.blog.example.com |
Wildcard certificates generally cover one label at the level of the asterisk. The zone apex needs its own certificate name, and deeper names need a wildcard or subject alternative name at the deeper level. A DNS wildcard and a certificate wildcard are separate configurations; creating one does not create the other.
Check the certificate actually presented
Use a TLS client to see the certificate selected for the hostname:
openssl s_client -connect tenant.example.com:443 -servername tenant.example.comInspect the certificate’s Subject Alternative Name entries, expiration, issuer, and chain. The -servername option is important because servers commonly select a certificate by SNI. If the certificate is valid for a different hostname, add the generated name to the certificate configuration or route the request to the correct TLS virtual host.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Check validation and renewal prerequisites
Automated wildcard issuance and renewal can require DNS-based control validation. Make sure the validation records are created in the authoritative zone and are not hidden behind an incompatible delegation or removed by an automated cleanup job. If a proxy is involved, confirm whether validation must reach the DNS provider directly or an HTTP endpoint at the origin, according to the certificate service’s documented method.
For DNS-only records, install a certificate that covers every public hostname on the origin and configure the server to present it. For proxied records, verify both the edge certificate and the certificate requirements for the edge-to-origin connection; a valid browser certificate does not guarantee that the proxy trusts the origin certificate.
Why one wildcard subdomain works while another fails
Different behavior between generated names is a useful clue rather than proof that wildcard DNS is unreliable. Check these differences in order:
- Different depth:
alpha.example.comuses*.example.com, whilealpha.blog.example.comneeds a wildcard belowblog. - Explicit override: the failing name has its own stale A, AAAA, CNAME, or delegation and therefore never reaches the wildcard.
- Typographical mismatch: the application constructs
tenant-01.example.comwhile the operator testedtenant01.example.com, or the dashboard added the zone suffix twice. - Different address family: one name returns only A records while the other returns an unreachable AAAA record.
- Application routing: DNS points both names to the same server, but the server or load balancer has a route for only one Host header.
- Certificate names: the working name is included in the certificate while the failing name is not.
- Cache or network view: one resolver has the corrected answer and another still has a cached NXDOMAIN or old address.
Special cases that cause misleading results
The apex and wildcard are different names
Visitors who enter example.com do not exercise *.example.com. Configure the apex separately and include it separately in the certificate. A redirect from the apex to a wildcard-generated host requires both names to resolve and both HTTPS names to be covered.
Deeper hostnames need their own scope
If an application creates names such as customer.region.example.com, decide whether the wildcard belongs at *.region.example.com or at another delegated zone. A first-level wildcard cannot be stretched across multiple labels. Document the naming convention so that provisioning automation writes records at the correct level.
Delegated subzones interrupt the parent wildcard
If blog.example.com is delegated to different nameservers, records in the parent zone do not control names inside that delegated subzone. Create the appropriate wildcard in the delegated zone and verify its own nameserver set. A parent-zone lookup can look correct while the child zone answers differently.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsDNSSEC can turn an apparent wildcard problem into SERVFAIL
When DNSSEC is enabled, a broken signature, stale DS record at the parent, or unsigned data where signed data is expected can cause validating resolvers to return SERVFAIL instead of an address. Compare responses from validating and non-validating resolvers, inspect the authoritative DNSSEC status, and correct the signing or delegation chain before changing the wildcard record.
Provider and architecture checks when selecting a DNS service
If the problem reflects a service choice rather than a single bad record, compare capabilities against the way your application is deployed. Verify current offerings directly because plans and features change.
| Capability to compare | Questions to ask |
|---|---|
| Wildcard A, AAAA, and CNAME support | Can the service create the record at the exact label and preserve the required target and TTL? |
| Authoritative nameserver control | Can you confirm delegation, edit the active zone, and manage child-zone delegations? |
| DNSSEC and API support | Are signing, DS changes, key rotation, audit logs, and safe automated updates available? |
| Proxy versus DNS-only behavior | Can each record be switched deliberately, and are edge addresses, origin allow-lists, and TLS responsibilities clear? |
| Wildcard certificate automation | Does the service issue and renew certificates for the exact wildcard levels and apex names you use? |
| Propagation visibility | Can you see record history, TTLs, authoritative responses, and changes still waiting in caches? |
| Monitoring and logs | Are DNS changes, failed validations, origin health, and resolver errors reported with timestamps? |
| Geographic availability and limits | Are there regional restrictions, query limits, API quotas, or plan limits that affect your generated host count? |
After the fix: verify from outside your own browser
Use a clean verification pass rather than relying on one cached browser session.
- Query the exact hostname for A, AAAA, and CNAME records through the authoritative server.
- Query it through at least two independent recursive resolvers and note TTLs and response codes.
- Open a private browser window or clear the local resolver cache after the expected cache period.
- Test HTTP and HTTPS with
curl -Iand confirm the returned status, redirect chain, and Server or proxy headers. - Inspect the presented certificate with the hostname supplied through SNI.
- Test from a second network, such as a mobile connection, to detect VPN, split-horizon, or local filtering effects.
- Check application and proxy logs for the exact Host header and request time.
An external DNS checker can provide useful geographic comparisons, but treat it as another recursive view rather than as authority. The authoritative answer remains the deciding evidence for whether the zone itself is configured correctly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Prevent recurring wildcard outages
- Keep an inventory of every wildcard, its level, record type, target, owner, and intended proxy status.
- Reserve a naming convention that distinguishes first-level tenants from deeper regional or application names.
- Protect wildcard records with change review and audit logging; an accidental explicit record can silently bypass the fallback.
- Monitor both DNS response codes and HTTPS health for representative generated names, including at least one name at every wildcard level.
- Monitor A and AAAA paths separately so an IPv6 regression does not hide behind a healthy IPv4 test.
- Renew certificates before expiry and test apex, first-level, and deeper names that require different certificate coverage.
- Document the authoritative nameservers and delegation chain so operators do not edit an inactive DNS provider during an incident.
- Record TTL and negative-cache behavior before planned migrations, allowing enough time for old answers to age out.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
