Fix the wildcard CNAME that points at a missing name
Why it matters
A wildcard CNAME sends every undefined subdomain to a name that does not exist, so every such subdomain is broken and each one could be taken over if the target becomes available. It affects far more names than one single record would.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Find the wildcard record (named * in the zone) and check what it points at.
- Decide whether you need a wildcard at all. Most sites only need explicit records for the subdomains they use.
- Before you delete it, list the subdomains that currently depend on it, using your logs and certificate transparency data, and create explicit records for any that are needed.
- Delete the wildcard, or point it at a working target you control.
- Check that the subdomains you need still resolve and that unknown subdomains return no record.
bash
dig CNAME anything-random.example.com +short dig CNAME '*.example.com' +short
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.