Wildcard DNS record

Whether an invented name under the domain resolves. A deliberate arrangement on plenty of sites and a surprise on others, so it is reported as a fact.

• Help center

A wildcard DNS record (*.example.com) answers for every name under the domain that does not have a record of its own. With one in place, anything.example.com resolves — including names nobody ever created.

How SiteScan checks

The scan asks for the A record of an invented name, sitescan-wildcard-probe.example.com, which no zone would carry on purpose. If it resolves, a wildcard is in place and the row reads "Present"; otherwise "Missing". Either way the row is neutral: SiteScan reports it as a fact, not a finding.

Why it matters

Wildcards are deliberate on many setups — multi-tenant SaaS with a subdomain per customer, hosting platforms, sites that catch typos. Elsewhere they are a leftover that surprises the owner:

• Every invented subdomain serves your site, or an error page, which can look like duplicate content to search engines and confuse visitors.
• Mail and certificate tooling may behave unexpectedly for names you never meant to exist.
• It hides mistakes: a typo in a link to a subdomain still resolves instead of failing loudly.

With a wildcard in place SiteScan also skips the CNAME check, since every name resolves there anyway. If you do not need one, delete the * record and create records for the subdomains you use. If you do, make sure the web server answers unknown hosts with a 404 or a redirect rather than with a copy of the site — see www variant.