Recommended Free Tools
Use one wildcard DNS record—such as *.example.com—to send every otherwise-unmatched tenant hostname to the same load balancer or web server. Your application, not DNS, then extracts the left-most label (for example, acme from acme.example.com), finds that tenant in its database, and enforces access. You do not create a DNS record for every user.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a wildcard subdomain setup actually does
A multi-tenant hostname design has three separate jobs:
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- DNS resolution: translates a hostname such as
acme.example.comto an IP address or target hostname. - Edge and web-server routing: accepts the request and forwards it while preserving the HTTP
Hostvalue. - Tenant selection and authorization: maps the hostname to an account and checks that the signed-in user may access it.
A wildcard record handles only the first job. It does not create a tenant in your database, provision permissions, create an application account, or choose a directory on disk. Those actions belong in your provisioning workflow and application.
For a domain named example.com, the usual pattern is:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
*.example.com A 203.0.113.10or a wildcard CNAME pointing to your ingress hostname. A request for acme.example.com, north.example.com, or another unassigned label can therefore reach the same ingress. Cloudflare’s DNS documentation describes entering * in the record’s Name field for this purpose and supports A, AAAA, and CNAME records for subdomains.
DNS wildcards are used only when a more-specific record does not exist. An explicit record for api.example.com, for example, can route that service separately while the wildcard handles tenant labels.
Choose a tenant hostname and data model first
Use a DNS-safe slug, not a display name
Choose the hostname format before adding DNS. A common choice is tenant-slug.example.com, where tenant-slug is a unique, normalized identifier stored in the application database. Keep that identifier separate from a company or player’s editable display name.
- Normalize case consistently; DNS names are case-insensitive, but your database lookup must not accidentally treat
Acmeandacmeas different tenants. - Allow only labels that your application can safely validate, such as letters, digits, and hyphens within DNS label length limits.
- Reject dots, slashes, control characters, whitespace, and malformed labels. A dot would create another DNS label rather than a single tenant slug.
- Reserve infrastructure names before accepting user registrations. Typical reservations include
www,api,admin,mail, and_acme-challenge. - Store a status such as active, suspended, or deleted so a hostname can be refused without deleting historical account data.
Separate provisioning from the first request
When a new account is created, your application should create its tenant row and slug first. The wildcard means there is no per-user DNS change to wait for. The first request can arrive immediately, but it should receive a valid response only after the tenant exists and is active in the database.
Step-by-step: create the wildcard DNS record
- Identify the authoritative DNS provider. Make the change where the domain’s authoritative nameservers are managed, not necessarily where the website is hosted.
- Create an A, AAAA, or CNAME record. In the provider’s DNS editor, enter
*(or*.example.com, depending on the provider’s interface) in the Name field. Point an A record to the public ingress IPv4 address, an AAAA record to the IPv6 address, or a CNAME to the load balancer or reverse-proxy hostname. - Keep the apex record separate. The wildcard
*.example.comdoes not replace a record forexample.com. Add an apex A/AAAA record or redirect the apex to the preferred tenant entry point. - Set a TTL appropriate to your operations. DNS responses can remain cached until their TTL expires. A changed target may therefore coexist with an older answer while caches age out; do not promise an instant cutover to users.
- Verify from an external resolver. Query a representative label such as
test-slug.example.comwith your normal DNS diagnostic tool and confirm that it returns the ingress address or target. Also query an explicit service record to ensure the wildcard has not replaced it.
Some providers proxy wildcard traffic through their edge network. If yours does, confirm that the edge has a certificate for the hostname pattern and that the original Host header is forwarded to your origin.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Configure NGINX to accept every tenant hostname
NGINX supports exact names, wildcard names, and regular-expression names. Its documented selection order gives exact names precedence over wildcard and regular-expression matches, which lets you keep infrastructure hosts such as api.example.com in separate server blocks.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A minimal TLS-facing block looks like this:
server {
listen 443 ssl;
server_name *.example.com;
# ssl_certificate and ssl_certificate_key are provider-specific
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://tenant_app;
}
}The important details are the wildcard server_name and the explicit preservation of Host. Your application needs that value to identify the tenant. Add a separate exact-name block for the apex or infrastructure services when they should not enter tenant routing.
When to use a named capture
NGINX also permits a constrained regular-expression server name with a named capture. The capture can be reused as a variable in routing configuration. This can be useful when the hostname format has a fixed suffix and you want the edge to pass the slug explicitly, but it increases configuration complexity. Validate the same slug again in the application; an NGINX capture is not an authorization decision.
Provide a safe default server
Requests with an unknown or malformed Host must not fall through to another tenant’s content. Configure a default server that rejects such traffic or returns a generic error. Do not let the first configured virtual host accidentally become the response for an unrecognized hostname.
Configure Apache for name-based tenant routing
Apache’s name-based virtual hosting selects content using ServerName and ServerAlias. A shared virtual host can accept tenant names while separate virtual hosts handle fixed services.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
<VirtualHost *:443>
ServerName example.com
ServerAlias *.example.com
DocumentRoot /var/www/tenant-app
ProxyPreserveHost On
ProxyPass / http://127.0.0.1:9000/
ProxyPassReverse / http://127.0.0.1:9000/
</VirtualHost>Use the modules and TLS directives appropriate to your Apache installation. The application should still read the forwarded host and perform the tenant lookup. Apache’s URL Rewriting Guide demonstrates mapping a captured site name into a path such as /home/%1/www, but that pattern must be tightly constrained and is not a substitute for authorization. Apache does not perform DNS resolution for you; the wildcard or CNAME must exist at the DNS provider.
Route the hostname to the correct account in your application
Process the request in a fixed order so routing and security cannot be bypassed:
- Obtain the host from the trusted server interface. Use the framework’s canonical host value after your proxy configuration is defined. Do not accept an arbitrary client field as the tenant key.
- Canonicalize it. Remove the expected suffix, compare case-insensitively, and extract exactly one left-most label. Reject unexpected ports, extra labels, empty labels, and invalid characters.
- Apply reservations. Stop routing for labels such as
api,admin, andwww, even if someone has attempted to create a database tenant with that name. - Look up the slug. Query a unique indexed tenant identifier and require an active status. Return a deliberate 404 or tenant-unavailable response for unknown, suspended, or deleted slugs.
- Authenticate and authorize. Finding a tenant is not permission to use it. Check the session, token, organization membership, role, and any account-level policy before serving data.
- Attach the tenant context. Pass the resolved tenant ID into every database query, cache key, background job, upload path, and audit event. Never rely on a user-supplied slug later in the request.
- Render or redirect only after authorization. Keep redirects, canonical URLs, and absolute links scoped to the validated tenant.
Never convert an unchecked hostname directly into a filesystem path, SQL fragment, shell argument, or backend URL. A malicious label can attempt path traversal, injection, SSRF, cache poisoning, or cross-tenant data exposure if it is used without validation.
Illustrative routing logic
host = request.canonical_host
suffix = ".example.com"
if not host.ends_with(suffix):
reject_bad_host()
label = host.remove_suffix(suffix)
if label contains "." or not matches_dns_slug(label):
reject_bad_host()
if label in RESERVED_SLUGS:
route_to_infrastructure_service_or_reject()
tenant = tenants.find_active_by_slug(label)
if tenant is null:
return_not_found()
require_membership(current_user, tenant.id)
request.tenant_id = tenant.idThe exact APIs differ by framework, but the invariants should remain: one validated slug, one database lookup, and authorization before tenant data is read.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHTTPS certificates for the apex and wildcard
If you serve both example.com and tenant hosts, issue a certificate containing both the apex name and the wildcard name: example.com and *.example.com. A wildcard name covers one label, so it does not cover deeper names such as user.tenant.example.com.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Cloudflare documents that, in its CNAME-based wildcard certificate setup, covering both names requires two domain-control-validation tokens at the authoritative DNS provider. Exact issuance and renewal steps vary with the certificate authority, DNS provider, and whether traffic is proxied at the edge.
Use DNS-01 for scalable wildcard issuance
DNS-01 validation is generally the scalable automation pattern for wildcard certificates because it proves control by publishing a temporary _acme-challenge record. Store the DNS API secret in a restricted secret manager, grant only the record permissions required for validation, and monitor renewal failures. Reserve _acme-challenge in your slug namespace so a tenant can never collide with the validation name.
Terminate TLS at the edge or reverse proxy, then decide whether origin traffic must also be encrypted. Whichever design you choose, test a newly created tenant over HTTPS, including certificate selection, redirects, cookies, and absolute links.
Wildcard DNS versus per-tenant DNS records
| Design | Operational model | Strengths | Costs and risks |
|---|---|---|---|
| Wildcard DNS plus shared ingress | One wildcard record sends many labels to the same edge; the application performs tenant lookup. | No DNS provisioning job for each account; simple to scale; consistent routing. | Requires strict host validation, safe defaults, and application-level authorization. |
| Per-tenant DNS records | Create and remove an explicit A, AAAA, or CNAME record for every account. | Granular DNS control and the option to send different tenants to different targets. | Provisioning, cleanup, retries, permissions, and DNS-cache behavior become part of every account lifecycle. |
| Path-based tenancy | Use URLs such as example.com/t/acme instead of a host label. |
One hostname and certificate; fewer wildcard-DNS concerns. | Different URL semantics, cookie and cache boundaries, and a less distinct tenant origin. |
Wildcard DNS is usually the cleanest choice when all tenants share an ingress and your application already has a reliable tenant lookup. Choose explicit records when accounts genuinely require separate targets, networks, certificates, or operational ownership.
NGINX or Apache?
| Question | NGINX | Apache |
|---|---|---|
| Hostname matching | server_name supports exact, wildcard, and regular-expression matching; named captures can become routing variables. |
Name-based virtual hosts use ServerName and ServerAlias; rewrite-based mappings are also possible. |
| Best fit | Teams already using NGINX as a reverse proxy or ingress and wanting compact host matching. | Teams using Apache modules, virtual-host conventions, or existing rewrite rules. |
| Primary caution | Regex captures and default-server behavior can create surprising matches if not constrained. | Rewrite rules can turn untrusted host text into paths unless the capture and authorization are tightly limited. |
| Application requirement | Preserve the host, resolve the tenant in application code, and authorize every request. | |
Testing checklist before production
- Resolve a new test label and confirm it reaches the intended ingress.
- Resolve the apex and every reserved service name; verify each has the intended explicit behavior.
- Request a valid active tenant over HTTP and HTTPS and confirm the expected redirect and certificate.
- Request an unknown slug and verify a controlled 404 or unavailable response, never another tenant’s page.
- Try uppercase, trailing-dot, extra-label, slash, dot, control-character, and overlong host variants; confirm canonicalization and rejection are consistent.
- Log the resolved tenant ID, request ID, host, status, and upstream result without logging secrets or sensitive tokens.
- Verify cache keys include the host or tenant context. A shared cache that keys only on the path can leak one tenant’s response to another.
- Check cookie scope, CORS, password-reset links, email links, webhooks, uploads, and background jobs for tenant isolation.
- Test a suspended tenant, a deleted tenant, and a user authenticated to one tenant who requests another tenant’s hostname.
- Confirm the default virtual host rejects unknown hosts and that the proxy forwards the original host exactly as your application expects.
Common failures and fixes
The hostname does not resolve
Check that the record was created at the authoritative provider, that the wildcard name uses the provider’s required syntax, and that the queried label has no conflicting explicit record. Review TTL caching before assuming the change failed.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
DNS resolves but the server returns the wrong site
Inspect virtual-host selection and the incoming Host. Add an exact server block for infrastructure names, keep the wildcard block separate, and configure a rejecting default server. In a proxy chain, verify that an intermediate load balancer is not replacing the host.
Every tenant sees “not found”
Log the canonical host and extracted label, then compare it with the stored slug. Common causes are an unexpected port, an extra suffix, case-sensitive database comparison, or a proxy that does not preserve Host.
An unknown host displays another tenant
This is a routing and isolation defect. Reject unknown hosts at the default virtual host and require an active tenant lookup before rendering. Review cache keys and any framework-level host fallback at the same time.
HTTPS fails for new tenant labels
Confirm that the edge certificate includes *.example.com, that the apex is covered separately when needed, and that the edge is actually serving the certificate you renewed. If DNS is proxied, check the provider’s edge certificate state and origin-host forwarding.
A new tenant works in one network but not another
Compare resolver answers and TTLs. Different recursive resolvers can retain old records for different periods. The wildcard avoids creating another record, but it cannot make already-cached DNS answers change instantly.
Operational safeguards for a growing tenant base
- Make slug creation transactional with tenant creation so an active hostname never points to a missing account.
- Keep a permanent or delayed reservation for deleted slugs if links, certificates, or abuse investigations depend on them.
- Monitor host rejection rates, unknown-slug requests, certificate-renewal status, and cross-tenant authorization failures.
- Rate-limit tenant creation and hostname probing to reduce enumeration and abuse.
- Document who can change wildcard DNS, proxy configuration, certificate automation, and reserved names. These are separate privileges.
- Use deployment tests that create a temporary tenant, exercise HTTPS and authorization, and remove it without touching production tenants.
When to choose a different architecture
Use explicit DNS records or separate ingress when tenants need isolated networks, independently managed certificates, regional routing, or different security policies. Use path-based routing when a single origin and certificate are more important than tenant-specific hostnames. Neither alternative removes the need to authorize every account request; they only change how the request reaches your application.
For the shared-host model, the durable division of responsibility is straightforward: wildcard DNS delivers the hostname to your edge, NGINX or Apache preserves and accepts it, and application code validates the slug, finds the tenant, and enforces membership. Treating those as separate controls prevents a DNS convenience from becoming a cross-tenant security problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
