Support Library
Wildcard DNS vs Explicit Records
Contrasts wildcard convenience with explicit-record governance and auditability.
Short Description
Contrasts wildcard convenience with explicit-record governance and auditability.
Why This Matters
Record strategy changes phishing surface area and troubleshooting clarity.
How It Happens
Wildcards catch undefined labels; explicit records require intentional host publication.
How to Detect It
Probe random labels and compare resolved responses.
How to Fix It
Constrain wildcard scope and use explicit records for high-risk namespaces.
Real-World Example
Explicit-record migration reduced phishing abuse under a major brand domain.
Related Checks in DNS Panopticon (map to product features)
Wildcard exposure and suspicious subdomain findings.
How DNS Panopticon Detects This
- Relevant checks: Delegation integrity, resolver consistency, DNSSEC health, and suspicious record-pattern checks.
- Severity mapping: Informational, medium/high, or critical based on exploitability and user impact.
- Score impact: Reliability and security scoring dimensions are reduced according to blast radius.
- Related findings users will see: NS drift, validation failure, orphaned CNAMEs, wildcard exposure, and policy misconfiguration alerts.
Operator Checklist
- Verify behavior from at least two public resolvers and one resolver inside your own network before making changes.
- Make one change at a time, capture before/after query output, and wait for TTL windows to clear so you can confirm impact.
- Document the root cause and the final fix in your runbook to shorten future incidents.