If you've ever seen *.example.com in DNS documentation or on an SSL Certificate and wondered what it means — this guide explains everything you need to know about Subdomain Wildcards, from basic concepts and DNS mechanics to real-world use cases and security best practices in 2026.
Table of Contents
- What Is a Subdomain? A Quick Refresher
- What Is a Subdomain Wildcard?
- Wildcard vs. Regular Subdomains — Comparison
- How Wildcard DNS Works
- Setting Up Wildcard DNS in DirectAdmin
- Wildcard SSL Certificates
- Use Cases — When Should You Use Wildcard?
- Security Risks & Best Practices
- Frequently Asked Questions
- Summary
1. What Is a Subdomain? A Quick Refresher
A subdomain is the part that appears before the main domain name, separated by a dot. For example, if the main domain is example.com, subdomains include www.example.com, mail.example.com, and shop.example.com.
Each subdomain can point to a different IP address or server, making it easy to separate services under a single domain.
The Structure of a Domain Name
| Part | Example | Description |
|---|---|---|
| Top-Level Domain (TLD) | .com / .net / .org | The rightmost part of the domain |
| Second-Level Domain (SLD) | example | The main registered domain name |
| Subdomain | www / mail / shop | The prefix before the main domain |
Example: shop.example.com → subdomain = shop, SLD = example, TLD = .com
2. What Is a Subdomain Wildcard?
A Subdomain Wildcard is a special DNS record that uses the asterisk (*) symbol as the subdomain prefix. It matches any subdomain name that hasn't been explicitly defined elsewhere.
Written as: *.example.com
When you have a DNS record
*.example.com → 203.0.113.1, it means every subdomain not otherwise defined — such as anything.example.com, test.example.com, client99.example.com — will resolve to IP 203.0.113.1 automatically.
Important: Wildcard records do not override explicitly defined subdomains. If www.example.com → 203.0.113.2 exists as a separate A record, DNS will use that record instead of the wildcard.
3. Wildcard vs. Regular Subdomains — Comparison
| Feature | Regular Subdomain | Wildcard Subdomain |
|---|---|---|
| DNS record creation | One record per subdomain | Single record covers all names |
| Dynamic subdomain support | No — requires manual DNS update | Yes — no DNS change needed |
| Management complexity | Low (explicit) | Requires app-level routing |
| Multi-tenant SaaS | Inconvenient | Ideal |
| Security considerations | Lower | Requires careful setup |
| Wildcard SSL compatible | Not needed | Perfect pair |
4. How Wildcard DNS Works
When a browser tries to resolve client5.example.com, the DNS lookup process works like this:
- Check for exact match: Is there a record for
client5.example.com? → Use it if found. - If no exact match → Check for wildcard: Is there a
*.example.comrecord? - If wildcard exists → Use the IP from the wildcard record.
- If neither exists → NXDOMAIN (domain not found).
*.example.com matches abc.example.com but does not match abc.def.example.com (a sub-subdomain). To cover deeper levels, you'd need a separate wildcard like *.def.example.com.
5. Setting Up Wildcard DNS in DirectAdmin
AsiaGB Hosting uses DirectAdmin as its control panel. Here's how to add a Wildcard DNS record:
Step-by-Step Setup
- Log in to your DirectAdmin control panel.
- Navigate to DNS Management.
- Select the domain you want to configure.
- Click Add Record.
- Fill in the fields:
- Name:
*(asterisk only) - Type:
A(or CNAME if pointing to a hostname) - Value: Your server's IP address
- TTL: 300 or 3600 as needed
- Name:
- Click Save.
* IN A 203.0.113.1Or as CNAME:
* IN CNAME example.com.
Verify After Setup
After saving, wait 5–30 minutes for propagation (for domains using AsiaGB nameservers), then test:
nslookup random123.example.com
# Should resolve to the IP you configured6. Wildcard SSL Certificates
A Wildcard SSL Certificate is issued specifically for *.example.com, securing every subdomain that the Wildcard DNS record covers — with a single certificate.
| Type | Covers | Price (AsiaGB) |
|---|---|---|
| Single Domain SSL | example.com only | From 1,000 THB/year |
| Wildcard SSL (DV) | *.example.com — all subdomains | From 5,000 THB/year |
| Wildcard SSL (OV) | *.example.com + organization validation | From 15,000 THB/year |
Combining Wildcard SSL with Wildcard DNS means every new subdomain you create automatically has HTTPS — no need to issue new certificates or modify SSL configuration for each one.
*.example.com covers shop.example.com but not test.shop.example.com.
7. Use Cases — When Should You Use Wildcard?
Multi-tenant SaaS Platform
Give each customer their own subdomain — company-a.yourapp.com, company-b.yourapp.com — without touching DNS every time a new customer signs up. The application handles routing based on the hostname.
Development & Staging Environments
Create dynamic environments per feature branch: feature-login.dev.example.com, feature-payment.dev.example.com, preview-pr-42.staging.example.com.
Microservices Architecture
Route traffic to different services dynamically: api-v1.example.com, api-v2.example.com, metrics.example.com.
White-label Services
Let partners access your platform through their own branded subdomain: partner1.service.com, partner2.service.com.
E-commerce Store Fronts
Allow merchants on a marketplace platform to have their own subdomain storefronts: merchant-abc.marketplace.com.
8. Security Risks & Best Practices
Common Risks
- Subdomain Takeover: If the Wildcard points to a CNAME that hasn't been claimed, it may be vulnerable to takeover attacks.
- Cookie Leakage: Domain-wide cookies can be read by any subdomain covered by the wildcard.
- Phishing: Attackers with server access could host deceptive content on convincing-looking subdomains.
Best Practices
- Use
__Host-cookie prefix to restrict cookies to the exact origin. - Implement application-level hostname validation — reject requests from subdomains not in your whitelist.
- Regularly audit active subdomains and remove unused DNS records.
- Set strict
Content-Security-Policyheaders. - Always use
HttpOnlyandSecureflags on sensitive cookies.
9. Frequently Asked Questions
10. Summary
- A Subdomain Wildcard (
*.domain.com) is a DNS record that matches any undefined subdomain automatically. - Ideal for Multi-tenant SaaS, Development Environments, Microservices, and White-label Services.
- Pair with a Wildcard SSL Certificate to enable HTTPS for all subdomains with one cert.
- Easy to configure in DirectAdmin: add an A record named
*pointing to your server IP. - Watch out for Cookie security and implement application-level hostname validation.
- Wildcard covers only one subdomain level — not sub-subdomains.