Wildcard records

The probe asks for a randomly generated label under the domain — a name that should not exist — and reports whether an address came back. An answer means a wildcard record is present, and every conceivable subdomain resolves.

It is graded as information because a wildcard is frequently deliberate: multi-tenant applications, catch-all hosting and per-customer subdomains all depend on one. What it costs is the NXDOMAIN signal. Nothing under the domain can ever report "does not exist", so a typo resolves, a decommissioned host keeps answering, and every monitoring check that would have caught a missing record now passes.

The wildcard rules are narrower than most people assume, and that cuts both ways. A wildcard synthesises only for names with no records of their own, and only for the record type asked for, so *.example.com does not shadow a real mail.example.com and does not invent an MX where the wildcard is an A record. It does not cover the apex either.

The exposure worth thinking about is the combination with a wildcard TLS certificate. Together they mean any hostname anyone invents under your domain — login-verify.example.com, say — resolves to your infrastructure and serves a page over HTTPS with a valid certificate and your name in the address bar. That is a convincing phishing surface, and you are hosting it.

If it is deliberate, keep it and make the default response explicit. A wildcard whose default virtual host serves the main application is what turns an invented hostname into a plausible page; one that answers with a bare 404 from a minimal server does not.

If it is not deliberate, remove it and publish the names you actually use. The lost convenience is real and the recovered signal is worth more: with NXDOMAIN back, a monitoring check on a name that has gone away fails instead of quietly succeeding.

Check what else the wildcard covers. A wildcard MX means every subdomain accepts mail, and a wildcard TXT can interfere with the _dmarc, _domainkey and _mta-sts lookups that expect either an answer or an NXDOMAIN and get a synthesised record instead.