[GH-ISSUE #1342] Wildcards match only one label #653

New issue

Open

opened 2026-03-15 23:42:19 +03:00 by kerem · 1 comment

kerem commented

2026-03-15 23:42:19 +03:00

Owner

Originally created by @SivaKesava1 on GitHub (Jan 11, 2021).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1342

Hello,

Wildcards can match not only one label but multiple whole labels (RFC 1034). Trust-DNS accepts wildcard records but matches only one label.

Consider the following example:


example.com.	500	SOA	ns1.outside.com. root.example.com. 3 604800 86400 2419200 604800
example.com.	500	NS	ns1.outside.com.
*example.com.	500	A	1.1.1.1

For queries of the kind, <something.example.com., A>, the server returns the A record. But if the query has more than one label before example.com, then the A record is not returned; instead, an NXDOMAIN is returned. Wildcards are pervasive in DNS - Surveying DNS Wildcard Usage Among the Good, the Bad, and the Ugly.

Originally created by @SivaKesava1 on GitHub (Jan 11, 2021). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1342 Hello, Wildcards can match not only one label but multiple whole labels ([RFC 1034](https://tools.ietf.org/html/rfc1034)). Trust-DNS accepts wildcard records but matches only one label. Consider the following example: | | | | | |- |- |- |- | | example.com. | 500 | SOA | ns1.outside.com. root.example.com. 3 604800 86400 2419200 604800 | | example.com. | 500 | NS | ns1.outside.com. | |*example.com. | 500 | A| 1.1.1.1 | For queries of the kind, `<something.example.com., A>`, the server returns the `A` record. But if the query has more than one label before `example.com`, then the `A` record is not returned; instead, an `NXDOMAIN` is returned. Wildcards are pervasive in DNS - [Surveying DNS Wildcard Usage Among the Good, the Bad, and the Ugly.](https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.259.7560&rep=rep1&type=pdf)

kerem added the

bug

crate:server

compliance

labels

2026-03-15 23:42:19 +03:00

kerem commented

2026-03-15 23:42:30 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jan 13, 2021):

Thanks for the report. This should be fixable, but will need some attention to detail as it's going to require changing lookup logic in the zones, etc.

@bluejekyll commented on GitHub (Jan 13, 2021): Thanks for the report. This should be fixable, but will need some attention to detail as it's going to require changing lookup logic in the zones, etc.