What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A wildcard subdomain fails for one of two broad reasons: DNS never returns an address, or DNS works but the proxy, web server, firewall, routing, or TLS configuration rejects the request. Start with the exact hostname that fails, then test it at the authoritative DNS provider. Confirm that the wildcard is at the correct level (for example, *.example.com or *.www.example.com), points to the intended A, AAAA, or CNAME target, and is not being overridden by a more-specific record.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
If the hostname returns NXDOMAIN or no address, stay in DNS until the authoritative answer is correct. If it resolves but a browser times out, refuses the connection, returns an HTTP error, or shows a certificate warning, move on to proxy mode, origin listeners, firewall and routing rules, Host/SNI handling, and certificate coverage.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What a wildcard subdomain does—and what it does not do
A wildcard DNS record is a fallback. It supplies an answer when a name below it has no more-specific record; it is not a blanket override for every name in the zone. Cloudflare’s DNS documentation states, “Specific DNS records take precedence over wildcard records,” a behavior defined in RFC 4592, The Role of Wildcards in the Domain Name System.
For a zone named example.com, a record at *.example.com can answer a query for tenant.example.com, provided there is no exact record or intervening delegation that takes precedence. It does not automatically create an answer for the apex example.com, and it does not automatically cover every deeper level.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Requested hostname | Wildcard label normally needed | What it can cover |
|---|---|---|
tenant.example.com |
*.example.com |
First-level names directly below example.com |
tenant.www.example.com |
*.www.example.com |
Names directly below www.example.com |
example.com |
An explicit apex record | Not supplied by *.example.com alone |
dev.blog.example.com |
A wildcard at the applicable deeper level | Not automatically supplied by *.example.com |
An asterisk must be the complete left-most label in the wildcard position. A name such as tenant.*.example.com contains a literal asterisk label and is not the same wildcard operation. An asterisk embedded in a label is literal as well.
Classify the failure before changing anything
Write down the full hostname and the exact symptom. The error class tells you where to begin and prevents changing the web server when the public DNS zone is wrong.
| Symptom | First place to investigate | Typical interpretation |
|---|---|---|
NXDOMAIN |
Authoritative DNS, delegation, record name, and target | The resolver found no associated DNS records for that name. |
| “Server not found” or no address | Authoritative and recursive DNS answers | The wildcard is missing, at the wrong level, overridden, or not yet visible through the resolver being used. |
| DNS resolves, then connection timeout | Proxy reachability, routing, firewall, and origin listener | An address exists, but traffic is not completing a TCP or proxy connection. |
| Connection refused | Origin service and listening port | The destination is reachable but is not accepting the requested port. |
| HTTP 4xx or 5xx | Reverse-proxy virtual host, Host header, application routing, or origin health | DNS worked and an HTTP component returned an application or proxy response. |
| TLS or certificate warning | Certificate names, validation, proxy mode, and SNI | The connection reached HTTPS, but the certificate or TLS handshake does not cover the hostname. |
Step-by-step repair workflow
1. Record the exact hostname and failure
Use the complete name, not just the parent domain: for example, tenant.example.com, dev.blog.example.com, or the name generated by your application. Note whether the failure is an NXDOMAIN, timeout, refusal, HTTP status, redirect loop, or certificate warning. Also note whether it occurs on HTTP, HTTPS, or both.
Check the name without relying on a browser first. A browser may combine DNS, cached redirects, proxy behavior, and certificate checks into one unhelpful message.
2. Confirm that you are editing the authoritative DNS zone
Find the domain’s authoritative nameservers, then make sure the wildcard is being created at the provider those nameservers identify. A record entered at a non-authoritative DNS dashboard cannot answer public queries, even if the interface accepts and displays it.
Check the delegation at the registrar or parent zone and compare it with the nameservers shown by your DNS provider. If the domain was recently activated or moved, verify that the active nameservers are the ones you intended. Cloudflare’s guidance for DNS_PROBE_FINISHED_NXDOMAIN specifically calls for reviewing the apex and active subdomain records when a newly configured name returns NXDOMAIN.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Also check whether you are editing the correct zone when several zones have similar names, such as example.com, www.example.com, and a staging domain. A wildcard in one zone has no effect on a different zone.
3. Create the wildcard at the correct level
For tenant.example.com, create an A or CNAME record whose name is * in the example.com zone. Many dashboards display the resulting fully qualified name as *.example.com.
For tenant.www.example.com, the wildcard belongs below www, normally as *.www when editing the example.com zone, producing *.www.example.com. Follow the dashboard’s convention: some interfaces expect only the relative label, while others accept the fully qualified name.
Choose a target that actually serves the request:
- A record: an IPv4 address for the intended origin or load balancer.
- AAAA record: an IPv6 address that is reachable and configured for the same hostname.
- CNAME record: a hostname supplied by your hosting or proxy service. Verify that the target itself resolves and is permitted by the provider.
Do not put an asterisk inside another label, such as tenant.*.example.com, and do not assume that a first-level wildcard answers a deeper name.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →4. Search for a record that overrides the wildcard
List records at the failing hostname and at each parent label. An exact record, a more-specific wildcard, or a delegation can prevent the broader wildcard from supplying the answer. This explains why one generated subdomain works while another does not: the working name may be using the wildcard, while the failing name has an explicit record with a wrong target or no usable service.
Look for these common overrides:
- An exact A, AAAA, or CNAME record pointing to an old server.
- An exact record with an empty or unexpected value in the provider’s interface.
- A delegated child zone, such as a separate
blog.example.comzone, whose nameservers answer instead. - A deeper wildcard with a different target.
- A record type conflict that your provider reports as invalid or refuses to publish.
Compare a working generated name with the failing one. Record type, target, proxy status, and the authoritative nameserver answering each query should be identical unless you intentionally designed them differently.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
5. Compare authoritative and recursive DNS answers
Query the exact hostname directly against an authoritative nameserver and then through at least one public recursive resolver. The purpose is to distinguish a bad zone from a stale cache.
- Use a DNS query tool such as
digornslookupto identify the domain’s authoritative nameservers. - Query the failing name at one of those authoritative servers and request A, AAAA, and CNAME records.
- Repeat the query through the resolver used by your network and through another independent recursive resolver.
- Compare the record type, address or target, and response status.
If the authoritative answer is correct but a recursive resolver still returns the old answer, wait for the relevant TTL and cache entries to expire, then test again. Do not “fix” an origin server to compensate for an answer that has not reached the resolver yet.
If the authoritative server also returns NXDOMAIN or no usable address, correct the zone, delegation, wildcard label, or target first. Cloudflare’s NXDOMAIN troubleshooting guidance recommends checking the active records and correct origin addresses, then allowing caches to update after changes.
6. Check proxy status and origin reachability
DNS resolution only proves that a resolver obtained an address or target. It does not prove that an HTTP server is listening, that a reverse proxy has a route for the hostname, or that a firewall allows the connection.
If the record is proxied, the proxy receives the client connection and then connects to your origin. Confirm that:
- The proxy can reach the configured origin address on the required HTTP or HTTPS port.
- The origin firewall allows traffic from the proxy service, not only from your office IP.
- The origin web server has a virtual host or site definition for the wildcard or requested hostname.
- The application accepts the expected
Hostheader and does not reject unknown tenants. - Health checks, load-balancer pools, and routing rules include the new hostname.
If the record is DNS-only, clients connect directly to the origin address. The origin must then accept the connection, present the HTTPS certificate, and handle the hostname itself. Cloudflare states that it can serve an SSL/TLS certificate for a DNS record only when the record’s proxy status is set to Proxied; with DNS-only records, TLS responsibility remains at the origin.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Test both protocols explicitly. For example, use an HTTP client to request the hostname and inspect the status and headers, then make a separate HTTPS request. A successful DNS lookup followed by an HTTP timeout points to transport or origin configuration, not wildcard syntax.
7. Verify certificate coverage and TLS validation
HTTPS has its own name-matching rules. A certificate for *.example.com covers first-level names such as tenant.example.com. It does not automatically cover the apex example.com or a deeper name such as dev.blog.example.com. Those names need explicit certificate coverage, often through additional subject names or a wildcard at the appropriate level.
Check the certificate actually presented for the failing hostname, not merely the certificate configured in a dashboard. The certificate’s names must match the browser’s requested host, and the server selected during the TLS handshake must see the correct SNI value.
When using a proxy, verify that the proxy-side certificate is active for the hostname and that the proxy can establish its own connection to the origin. When using DNS-only, inspect the origin certificate chain, expiration, supported protocol, and virtual-host selection.
Wildcard certificate issuance and renewal may require DNS-based domain-control validation. Cloudflare documents that validation requirements depend on the certificate setup, so a DNS wildcard that resolves correctly can still fail HTTPS if validation has not completed or renewal cannot reach the required DNS record.
8. Retest from independent networks
After correcting DNS or origin settings, test from more than one path:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- A private browser window to avoid cached redirects and session state.
- Your normal recursive resolver and a separate public resolver.
- A mobile connection or another network to expose split-horizon DNS, VPN, and local filtering.
- An external DNS-checking service to compare answers by location.
If only one network fails, inspect its local DNS cache, VPN, security software, or filtering policy. If every network fails but the authoritative answer is still wrong, continue working at the DNS provider. Cloudflare’s troubleshooting categories include stale upstream responses and unexpected records, both of which are easier to identify by comparing networks and resolvers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why one wildcard subdomain works while another does not
Different generated names do not necessarily follow the same path. Compare the complete DNS and HTTP chain for one working name and one failing name.
| Comparison | What a difference means |
|---|---|
| Exact DNS record | The failing name may override the wildcard with an outdated or empty target. |
| Parent zone or delegation | The names may be answered by different authoritative zones. |
| Wildcard depth | tenant.example.com and tenant.www.example.com require different wildcard levels. |
| Target address | One target may have a listener or route while the other is offline. |
| Proxy status | One name may receive proxy TLS and filtering while the other connects directly to the origin. |
| Application routing | The web server or application may recognize one Host header but reject another. |
| Certificate names | A certificate can cover one depth of hostname but not another. |
Use the same diagnostic commands and request headers for both names, changing only the hostname. This turns a vague “wildcard” problem into a measurable difference in DNS answer, connection path, HTTP route, or certificate.
DNS-only versus proxied operation
The correct mode depends on who should terminate TLS and handle traffic.
| Setting | Client connects to | Who must provide the public certificate | Checks required |
|---|---|---|---|
| DNS-only | The address returned by the DNS record | Your origin server | Origin listener, firewall, routing, Host/SNI handling, certificate chain, and application route |
| Proxied | The proxy edge, which then contacts the origin | The proxy for the client side; the origin still needs a compatible proxy-to-origin TLS setup when HTTPS is used there | Proxy status, edge certificate, origin reachability, allowed source ranges, health checks, and Host/SNI expectations |
Switching modes can change the visible failure. A DNS-only record may expose an origin certificate warning that the proxy would mask, while proxying can expose an origin timeout or a blocked proxy-to-origin connection. Treat a mode change as a diagnostic step, not proof that the underlying DNS record is fixed.
Wildcard certificates and deeper hostnames
Plan DNS and certificate scope together. A wildcard DNS record at *.example.com can answer many first-level names, but the HTTPS certificate must contain those same names. The apex requires separate coverage, and deeper labels require a certificate name that reaches that depth.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFor a service that creates both customer.example.com and customer.app.example.com, decide whether you need one certificate with multiple names, separate certificates, or wildcard coverage at both levels. Confirm the certificate provider’s validation and renewal process before production deployment, especially when DNS-based validation records are managed in a different zone.
Choosing a DNS service for wildcard workloads
If your current provider cannot express the required wildcard or gives little visibility into propagation, compare services on operational capabilities rather than on a wildcard checkbox alone.
| Capability | Questions to ask |
|---|---|
| Wildcard A/CNAME support | Can the service publish wildcards at the zone levels you need, and does its UI accept relative and fully qualified names predictably? |
| Authoritative control | Can you manage the nameservers and verify delegation at the parent zone? |
| DNSSEC and API | Does it support DNSSEC and an API suitable for repeatable record creation and auditing? |
| Proxy versus DNS-only | Can each record be placed in the intended mode, and is the mode visible during troubleshooting? |
| Wildcard certificate automation | Can certificates be issued and renewed for the required hostname depth, with DNS validation that your team can maintain? |
| Propagation visibility | Are authoritative answers, TTLs, change history, and regional results available to operators? |
| Logging and monitoring | Can you detect unexpected records, failed updates, stale responses, and origin health problems? |
| Geographic availability and limits | Are the service, API quotas, and relevant features available in your region and plan? |
| Current pricing | What recurring charges or plan limits apply to the records, queries, proxy traffic, and certificates you actually need? |
Verify these details directly with the provider before committing; feature names, limits, and prices change.
Quick Recap
Final recovery checklist
- Write down the exact failing hostname and classify the error.
- Confirm the domain’s authoritative nameservers and edit that zone.
- Place the wildcard at the correct level:
*.example.comversus*.www.example.com. - Use the intended A, AAAA, or CNAME target and verify that the target itself is valid.
- Search for exact records, deeper wildcards, and delegated child zones that override the fallback.
- Compare authoritative answers with multiple recursive resolvers and allow cache or TTL expiry after changes.
- Confirm proxy status and make sure the proxy or direct origin can reach a listening service.
- Check firewall, routing, load-balancer health, virtual-host configuration, and application Host-header handling.
- Verify that the presented certificate covers the exact hostname depth and that validation and renewal are healthy.
- Retest from a private browser session and an independent network before declaring the issue resolved.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
