What is a wildcard DNS record?

Short answer

A wildcard DNS record is written in the *.example.com form and makes the same answer return for subdomains that are not defined separately in the zone (RFC 4592); e.g. if there is no separate record for abc.example.com or test.example.com, the answer of the wildcard record is returned. An explicitly defined name takes precedence over the wildcard. In TR7 GTM, * or *.x can be written for the record name in the Record Name field; the domain name itself, however, cannot contain *. In the AGS Portal flow, the Private Tunnel Domain setting requires a wildcard DNS record in the *.domain form and a wildcard certificate covering these names, because of the subdomains generated for each application.

Where It Is Used in TR7

Where	Field / label	What for
GTM → GTM Services → service name → Records → Add	Record Name = * or *.x	A common answer for undefined subdomains
GTM → GTM Services → service name → Domains → Add	Domain Name	* is not accepted in the domain name; the wildcard is used only in the record name
Left Monitor Panel → AGS-Enabled vServices → vService → Flowchart (Gateway mode: Portal)	Private Tunnel Domain	The requirement for a *.domain wildcard record and a wildcard certificate for the {hash}.domain addresses generated per application

• The wildcard is used only in the leftmost label: *.dev is valid, a.* is invalid and gives the Invalid record name warning.
• Example: if the example.com zone has * → A → 203.0.113.10 and www → A → 203.0.113.20, 203.0.113.20 is returned for www.example.com and 203.0.113.10 for abc.example.com.

Common Misconceptions

• "A wildcard record also overrides the defined subdomains." An explicitly defined name always takes precedence; the wildcard answers only the names that are not in the zone.
• "A wildcard DNS record is the same thing as a wildcard certificate." One is name resolution, the other is a TLS certificate; for HTTPS, both are needed separately (What is a wildcard certificate?).
• "A *.example.com record covers two-level subdomains in every case." For a.b.example.com, if there is no b.example.com name in the zone, the wildcard answers; if there is any record at the b.example.com name, the wildcard is not applied and NXDOMAIN is returned.

How it is done in the documentation

• Records · Record Name
• Domains · Domain Name
• Portal · Private Tunnel Domain

Related questions

• What is a wildcard certificate?
• Can I do Virtual Hosting with a wildcard domain (*.example.com)?
• Can I use a wildcard certificate?