Is a wildcard DNS record bad practice

domain-name-systemsubdomainwildcard

I asked my hoster to add three subdomains all pointing to the IP of the A record. It seems he simply added a wildcard DNS record because any random subdomain resolves to my IP now. This is OK for me from a technical point of view, since there are no subdomains pointing anywhere else. Then again I don't like him not doing what I asked for. And so I wonder whether there are other reasons to tell him to change that. Are there any?

The only negative I found is that someone could link to my site using http://i.dont.like.your.website.mywebsite.tld.

Best Answer

If you ever put a computer in that domain, you will get bizarre DNS failures, where when you attempt to visit some random site on the Internet, you arrive at yours instead.

Consider: You own the domain example.com. You set up your workstation and name it. ... let's say, yukon.example.com. Now you will notice in its /etc/resolv.conf it has the line:

search example.com

This is convenient because it means you can do hostname lookups for, e.g. www which will then search for www.example.com automatically for you. But it has a dark side: If you visit, say, Google, then it will search for www.google.com.example.com, and if you have wildcard DNS, then that will resolve to your site, and instead of reaching Google you will wind up on your own site.

This applies equally to the server on which you're running your web site! If it ever has to call external services, then the hostname lookups can fail in the same way. So api.twitter.com for example suddenly becomes api.twitter.com.example.com, routes directly back to your site, and of course fails.

This is why I never use wildcard DNS.

Related Solutions

Is a wildcard CNAME DNS record valid

It is possible to do this. At one point it was up in the air a bit until 4592 clarified that it should be supported.

Just because it is possible doesn't mean it is supported by all DNS providers. For example, GoDaddy won't let you set up a wildcard in a CNAME record.

In terms of whether it is advisable or not to do this, it depends on your usage. Usually CNAMES are used for convenience when you are pointing to an "outside" domain name that you don't control the DNS on.

For example, let's say you set up a CMS system that allows you to have *.mycms.com as the site name (it uses host headers). You want customers to be able to easily set up *.cms.customer.com, without worrying that you might change your IP address at some point. In that case, you could advise them to set up a wildcard CNAME called *.cms.customer.com to www.mycms.com.

Because wildcard CNAMES aren't supported by all providers (such as GoDaddy), I wouldn't advise using it in a case where you suggested it for various customers (where you don't know their provider's capabilities).

Wildcard DNS, VirtualHosts on apache2, 404 for unused subdomains

I recently had the same issue and could not find a soultion until now. The best option turns out to be using

Redirect 404 /

or (as suggested earlier)

RedirectMatch 404 /.*

directive in the default (first) vhost, which obviously must be unused. The vhost can potentially be a 'fake' one, so something like following at the beginning of your vhost config file:

<VirtualHost *:80>
ServerName default #fake name, unused domains default here
Redirect 404 /
</VirtualHost>

<VirtualHost *.80>
ServerName example.tld
........
</VirtualHost>

Smells like a hack though.

Best Answer

Related Solutions

Is a wildcard CNAME DNS record valid

Wildcard DNS, VirtualHosts on apache2, 404 for unused subdomains

Related Topic