Recommended Free Tools
To route arbitrary subdomains to Nginx, configure two independent layers: a DNS wildcard such as *.example.com that sends otherwise-unanswered names to the Nginx host, and an Nginx server block that matches those Host headers. Use exact server_name blocks for applications that need their own backend. For a genuine catch-all, make the intended block the default_server on the relevant listen address and port; server_name _ by itself does not catch every hostname.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
HTTPS adds a certificate constraint: a certificate for *.example.com covers one subdomain level, not the apex example.com or a deeper name such as a.b.example.com. Wildcard certificate issuance requires the DNS-01 challenge, which proves control by publishing a TXT record under _acme-challenge.
As an Amazon Associate I earn from qualifying purchases.
What “catch-all subdomain” means
People use “catch-all” for several related behaviors. Keeping them separate prevents a configuration that appears correct but fails before Nginx ever receives a request.
| Layer | What it does | What it does not do |
|---|---|---|
| DNS wildcard | A record such as *.example.com answers otherwise-unmatched names with the address of your Nginx host. |
It does not select an Nginx site, create certificates, or override a more-specific DNS record. |
| Nginx wildcard name | server_name *.example.com; matches Host names in that domain and participates in Nginx’s name-precedence rules. |
It does not make DNS resolve, and it is not the mechanism that defines the default server. |
| Default server | listen 80 default_server; (or the equivalent HTTPS listen) receives a request whose Host does not match another server block on that address and port. |
It does not create DNS records or make a certificate valid for arbitrary names. |
A working deployment normally needs the first two. The third determines where unmatched traffic goes, including requests for names outside your intended domain that happen to reach the IP address.
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
Plan the DNS zone before touching Nginx
Create the wildcard record
At the authoritative DNS provider for example.com, add a wildcard address record:
*.example.com. A 203.0.113.10Use the real public IPv4 address of the Nginx host in place of the documentation address above. Add an AAAA record as well if the service is intentionally reachable over IPv6. DNS providers expose different controls and flattening behavior, so verify how that provider handles wildcard records rather than assuming every name will be synthesized identically.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA wildcard answers names that do not have a more-specific record. If api.example.com already has its own A, AAAA, CNAME, or other applicable record, that record takes precedence over the wildcard. This is useful: you can let most tenants or environments use the shared address while delegating selected names elsewhere.
Decide whether the apex must resolve
*.example.com does not represent the zone apex example.com. If the bare domain should also reach Nginx, create an explicit apex record at the DNS provider, commonly an A and/or AAAA record, or use the provider’s apex-alias feature where available. A request for example.com otherwise fails DNS even though one.example.com works.
Confirm DNS independently
Test a name that has no explicit record before debugging Nginx:
dig +short random-test.example.com A
dig +short random-test.example.com AAAAThe response should contain the address of the Nginx host. Test an explicit application name and the apex separately because each can follow a different DNS path. If the random name returns no address, a browser, curl, and Nginx logs cannot help yet; the request never reaches the server.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build the HTTP configuration
Use a wildcard block for the shared site
The following pattern serves a default filesystem site for wildcard subdomains while preserving a dedicated application at app.example.com:
Rank #2
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
server {
listen 80 default_server;
server_name *.example.com;
root /srv/www/default;
location / {
try_files $uri $uri/ =404;
}
}
server {
listen 80;
server_name app.example.com;
proxy_pass http://127.0.0.1:3000;
}The first block is both the wildcard site and the default for port 80 on that listen address. The second block is not a default; an exact match for app.example.com therefore wins and is proxied to its own backend. Replace the document root, upstream address, and application-specific locations with the values used by your deployment.
Include the apex when it belongs to the same site
Nginx provides a special leading-dot form. server_name .example.com; matches the apex and wildcard names in one block. Use it when the bare domain and all subdomains should share the same handling:
server {
listen 80 default_server;
server_name .example.com;
root /srv/www/default;
location / {
try_files $uri $uri/ =404;
}
}If the apex needs different content or redirects, keep it as an exact name in its own block instead. The choice in Nginx does not remove the DNS requirement: the apex still needs an apex DNS record.
Make the intended block the real catch-all
Nginx selects the default server from the listen directive. There is no special catch-all value for server_name. The commonly seen server_name _; is merely a conventional name that is unlikely to match a real Host header; it becomes a catch-all only when its server block is marked default_server for that listen socket.
Do not declare two default_server blocks for the same IP address and port. If Nginx listens on multiple addresses, IPv4 and IPv6 sockets, or nonstandard ports, decide the default independently for each socket and test each one.
Understand Nginx name precedence
When several server blocks listen on the same address and port, Nginx chooses by name specificity before falling back to the default:
- An exact name such as
app.example.comwins over wildcard names. - When wildcard names apply, the longest applicable wildcard wins.
- If no name matches, Nginx uses the server marked
default_serverfor thatlistensocket.
This lets you add explicit sites without dismantling the catch-all. Keep a block such as server_name admin.example.com; for an administration service, and leave the broad wildcard for everything else. A request with an unexpected Host header will still land in the default block, so choose its content deliberately instead of exposing an unintended application.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 𝙊𝙣𝙚 𝙎𝙬𝙞𝙩𝙘𝙝 𝙈𝙖𝙙𝙚 𝙩𝙤 𝙀𝙭𝙥𝙖𝙣𝙙 𝙉𝙚𝙩𝙬𝙤𝙧𝙠: 24 port of 10/100/1000Mbps RJ45 Ports supporting Auto Negotiation and Auto MDI/MDIX
- 𝙂𝙞𝙜𝙖𝙗𝙞𝙩 𝙩𝙝𝙖𝙩 𝙎𝙖𝙫𝙚𝙨 𝙀𝙣𝙚𝙧𝙜𝙮: Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money
- 𝙍𝙚𝙡𝙞𝙖𝙗𝙡𝙚 𝙖𝙣𝙙 𝙌𝙪𝙞𝙚𝙩: IEEE 802. 3X flow control provides reliable data transfer and Fanless design ensures whisper quiet operation
- 𝙋𝙡𝙪𝙜 𝙖𝙣𝙙 𝙋𝙡𝙖𝙮: Easy setup with no software installation or configuration needed, just plug it in and start
- 𝙈𝙚𝙩𝙖𝙡 𝘾𝙖𝙨𝙞𝙣𝙜: Metal-cased switches provide superior durability, heat dissipation, and EMI protection, making them the clear choice for reliable performance over cheaper plastic switches.
Configure HTTPS without exceeding certificate scope
Plan names for the certificate
A wildcard certificate for *.example.com covers one label level, for example shop.example.com. It does not cover example.com itself or a deeper host such as a.b.example.com. The deeper name needs additional certificate coverage, such as a certificate containing that specific name or an appropriate deeper wildcard.
If both the apex and first-level subdomains use the same TLS server, request a certificate containing example.com and *.example.com as separate names. Keep certificates for explicitly hosted applications separate when those applications require different names, trust boundaries, or renewal policies.
Use DNS-01 for wildcard issuance
HTTP-01 cannot issue wildcard certificates. The DNS-01 challenge validates control by requiring a TXT record at _acme-challenge.example.com (or the corresponding challenge name for the requested domain). An ACME client can automate renewal when your DNS provider offers an API; otherwise, each renewal requires the TXT value to be published and publicly visible before validation.
Create the HTTPS server blocks
server {
listen 443 ssl default_server;
server_name *.example.com;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
root /srv/www/default;
location / {
try_files $uri $uri/ =404;
}
}
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/ssl/app/fullchain.pem;
ssl_certificate_key /etc/ssl/app/privkey.pem;
proxy_pass http://127.0.0.1:3000;
}Install certificate files with permissions that allow Nginx to read the private key, then verify that every hostname users will enter is present in the certificate’s names. The HTTPS default block handles unmatched SNI/Host combinations on that socket, but it cannot make an unmatched name appear in a certificate.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Redirect HTTP only after HTTPS is ready
If the policy is HTTPS-only, first prove that the certificate and backend work on port 443. Then change the port-80 default block to issue a redirect, while retaining exact HTTP blocks only where an application requires a different transition. Redirecting before DNS and certificate validation are complete can turn a simple routing error into a confusing TLS error.
Deploy in a safe order
- Publish DNS. Add the wildcard record and any required apex or explicit records. Wait until an unknown test name resolves to the intended Nginx address.
- Add explicit application blocks. Define exact names for services that need distinct upstreams or certificates.
- Add the HTTP wildcard/default block. Confirm that the
listenaddress and port are the ones receiving public traffic. - Validate syntax. Run
nginx -tand correct every reported error before reloading. - Reload, do not restart unnecessarily. Use the service manager’s reload operation, for example
systemctl reload nginx, so existing connections are not needlessly dropped. - Test both paths. Request one explicit hostname and one previously undefined hostname. The explicit request must reach its own backend; the undefined request must show the catch-all content.
- Add TLS. Obtain the required certificate names with DNS-01, install them, add the port-443 blocks, validate again, reload, and inspect the certificate presented for each hostname.
Test routing before relying on public DNS
Check the Host-based choice over HTTP
Once DNS resolves, issue requests with headers that make the selected name unambiguous:
curl -i -H 'Host: app.example.com' http://203.0.113.10/
curl -i -H 'Host: random-test.example.com' http://203.0.113.10/The first response should contain the application’s response from port 3000; the second should contain the default site’s response or its intentional rejection. Testing the IP directly without a Host header is not equivalent, because it exercises whichever server is default for that socket.
Rank #4
- 【Build Your Own NAS & Homelab — Not Just Storage】 More than a traditional NAS, ZimaBlade 7700 is a flexible x86 mini server for building your own homelab, personal cloud, or Docker host. Perfect for DIY NAS, self-hosting, container apps, and even retro systems — not limited like typical ARM-based NAS devices.
- 【x86 Platform — Broad Compatibility, Real Freedom】 Powered by an Intel quad-core x86 processor, it runs a wide range of operating systems and software with native compatibility. Ideal for Linux, Docker, CasaOS, and more — designed for flexibility and experimentation rather than locked-down appliance use.
- 【16GB RAM for Smooth Multi-Service Workloads】 Handle file sharing, media streaming, backups, and multiple lightweight services at once. Optimized for low-power, always-on operation — a great fit for home labs and personal servers running 24/7.
- 【Smooth 4K Media Streaming — Plex Direct Play Ready】 Stream your personal media library smoothly with Plex and similar media servers. Supports 4K playback on compatible devices via direct play, delivering a reliable home media experience without the need for heavy transcoding.
- 【Complete 2-Bay NAS Kit — Ready to Build】 Includes power supply, 16GB RAM, metal drive cage for 2 HDD/SSD, and dual SATA cables — everything you need to start building your own NAS right out of the box.
Test HTTPS certificate selection
For a hostname that already resolves publicly, use:
curl -Iv https://random-test.example.com/For a pre-DNS or staging test, map the name to the address while retaining SNI and Host:
curl -Iv --resolve random-test.example.com:443:203.0.113.10 https://random-test.example.com/Inspect the certificate names in the verbose output. Repeat with app.example.com to ensure the explicit block presents the intended certificate and backend.
Use a small test matrix
| Test name | DNS expectation | Nginx expectation | Failure points to |
|---|---|---|---|
app.example.com |
Its explicit A/AAAA record or the wildcard address | Exact application block | Application block, listen socket, or upstream |
new.example.com |
Wildcard address | Wildcard/default content | DNS wildcard or default-server selection |
example.com |
Explicit apex record | Exact apex block or a leading-dot block | Apex DNS or missing apex name |
a.b.example.com |
Provider-dependent wildcard behavior and any explicit record | Matching Nginx name if configured | DNS hierarchy or TLS certificate depth |
Troubleshoot by locating the failing layer
The random subdomain does not resolve
Run dig against the authoritative and public resolvers you normally use. If there is no address, inspect the wildcard record’s name, record type, delegation, and provider-specific restrictions. Do not change Nginx yet: no HTTP request has reached it.
It resolves but displays the wrong site
First confirm the request’s destination address and port. Then list every enabled server block that listens on that socket and check for an exact name or a longer wildcard that should win. Verify that the intended block, not an unrelated block, carries default_server. The conventional server_name _ line is not evidence that a block is the default.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe apex fails while subdomains work
This is expected when only *.example.com exists in DNS. Add an apex record and either include example.com explicitly in Nginx or use server_name .example.com; when both should share handling.
HTTPS reports a name mismatch
Compare the requested name with the certificate’s SANs. A first-level wildcard does not cover the apex or a.b.example.com. Request and install a certificate that includes every required name, and make sure the HTTPS block selected for that SNI name points to the corresponding certificate.
Best Value
- Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
- Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Wildcard issuance fails
Use DNS-01 rather than HTTP-01 for a wildcard request. Confirm that the ACME client created the TXT value at the correct _acme-challenge name and that public DNS queries can see it. Stale authoritative data, publishing the TXT at the wrong level, and API credentials that cannot update the zone are common causes.
Nginx will not reload
Run nginx -t and read the first configuration error, including the file and line number. Typical causes are duplicate default_server declarations on one socket, a missing semicolon, a certificate path that does not exist, or a private key that Nginx cannot read. Correct the reported issue, test again, and reload only after a successful validation.
Choose the pattern that matches your routing goal
| Pattern | Use it when | DNS work | HTTPS work | Main trade-off |
|---|---|---|---|---|
Wildcard DNS plus server_name *.example.com |
First-level subdomains share a site or dynamic tenant handler. | Publish one wildcard record; add explicit records where needed. | Use a one-level wildcard certificate and separate names for apex/deeper hosts. | Clear separation between wildcard names and the apex. |
Wildcard DNS plus server_name .example.com |
The apex and all subdomains should use identical handling. | Still publish an explicit apex record; DNS wildcard alone does not cover it. | Certificate still needs both apex and wildcard names. | Convenient Nginx matching, but less suitable when apex behavior must differ. |
| Default server without a domain wildcard | You need a sink or fallback for any Host that already resolves to the IP. | Each intended hostname still needs DNS; the default does not create records. | The default certificate is shown to unmatched names and must be treated accordingly. | Useful as a safety net, not a replacement for wildcard DNS. |
| Exact blocks only | Every public hostname is known and should be explicitly controlled. | Create records per hostname. | Issue certificates per exact name or selected SAN set. | More administration, but the narrowest routing scope. |
Operational decisions for a production catch-all
Keep tenant or application routing explicit
If the catch-all sends traffic to a dynamic application, derive the tenant from a validated hostname rather than trusting arbitrary input. Define what happens for unknown tenants: a controlled 404, a registration page, or a hard rejection. Never let an accidental Host value select an internal upstream.
Log the hostname used for routing
Include the request host, selected upstream, status, and request ID in logs. When a wildcard and several exact blocks coexist, hostname-aware logs make precedence mistakes visible without changing the configuration.
Automate certificate renewal carefully
Wildcard renewal depends on reliable DNS-01 TXT updates. Give the ACME client only the DNS permissions it needs, monitor renewal failures, and test that a renewed certificate is actually loaded after Nginx reloads. A valid certificate file on disk is not enough if the running worker processes still serve the old one.
Account for every listen socket
Repeat the design for IPv6 if an AAAA record is published, and for every public port you expose. A correct port-80 default does not imply a correct port-443 default; each listen address and port has its own server selection.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Final checklist
- The DNS wildcard points to the Nginx host, and more-specific records are intentional.
- The apex has its own DNS record if it must work.
- Exact Nginx names exist for applications that need separate backends.
- The shared block is marked
default_serveron the correct listen socket. - You are not relying on
server_name _as a substitute for a default server. nginx -tsucceeds before every reload.- The certificate covers the apex, wildcard level, and any deeper names actually used.
- Wildcard certificates are issued with DNS-01 and the
_acme-challengeTXT record is publicly visible. - One explicit host and one previously undefined host have been tested over HTTP and HTTPS.
With DNS directing unknown subdomains to the host, Nginx matching wildcard names, and a deliberate default server handling everything else, new first-level subdomains can work without a new server block each time. Explicit names still retain priority, while certificate scope and DNS behavior define the limits of the catch-all.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
