Subdomains and wildcards

Module 3: Records for your website · Reading time: 7 minutes

Learning objective: After this lesson you'll be able to create a subdomain via the DNS and explain how a wildcard works and where it doesn't apply.

Key concepts: subdomain, wildcard (*), "an existing name wins", wildcard and deeper levels, subdomain in the hosting panel versus just a DNS record

What is a subdomain?

A subdomain is a name placed before your domain name: shop.example.com, blog.example.com, mail.example.com. Even www.example.com is technically just a subdomain. You don't need to register or pay for one: whoever holds the domain example.com may create as many names under it as they like. A subdomain comes into being when you create a record for it.

A subdomain can also be several levels deep: test.shop.example.com is perfectly valid. Each part between the dots can be up to 63 characters, and the whole name up to 253 characters.

Two kinds of subdomains

In practice, "creating a subdomain" means two different things, and this confuses a lot of people.

1. Just a DNS record. You create an A, AAAA or CNAME record in the DNS for shop. This tells the world where shop.example.com lives. If it points to an external service, such as an online shop platform, you're done: that service takes care of the website.

shop.example.com.   3600  IN  CNAME  shops.platform.example.

2. A subdomain in your hosting panel. In a hosting panel, you can also create a subdomain. This does two things: the panel adds a record in the DNS (if the DNS is managed there), and it also sets up the web server with its own folder for that subdomain's files. You need this when the subdomain's website is hosted on your own hosting account, for example a second WordPress installation on blog.example.com.

Two pitfalls:

• If your DNS is managed somewhere other than your hosting (different nameservers, see lesson 2.1), the panel will add the record in a place nobody checks. In that case, create the record yourself with the party that manages the DNS.
• If you want a subdomain to point to an external service, do not create it in the hosting panel, only as a DNS record. Otherwise you'll end up with two records for the same name that conflict with each other.

The wildcard: one record for all names

A wildcard is a record with an asterisk as its name:

*.example.com.   3600  IN  A  192.0.2.10

This means: "every name under example.com that isn't otherwise listed in the zone points to 192.0.2.10". If someone looks up blog.example.com, test.example.com or wat-dan-ook.example.com, and that name doesn't exist separately, the DNS returns the wildcard's answer.

Many hosting packages set up a wildcard by default. This means a new subdomain in the hosting panel works immediately, without needing a separate record for every name. www then also works automatically.

Where a wildcard doesn't apply

The rules for wildcards are laid out in RFC 4592. Three things are useful to know.

An existing name wins. If there's a dedicated record for shop.example.com, the wildcard isn't used for that name. This also applies to other record types: if shop only has a CNAME, the wildcard no longer provides an A record for shop either. So a wildcard is a safety net for names that don't exist at all.

*.example.com.     A      192.0.2.10
www.example.com.   CNAME  shops.platform.example.

Here, blog.example.com goes to 192.0.2.10, but www.example.com goes to the platform.

A wildcard doesn't apply to the bare domain. *.example.com doesn't cover example.com itself. You need a dedicated record for that.

A wildcard doesn't apply under a name that exists. If shop.example.com exists, *.example.com doesn't cover the name test.shop.example.com. The wildcard only works for names whose entire "path" doesn't exist. If shop doesn't exist, test.shop.example.com does fall under the wildcard. If you want a wildcard under shop, create *.shop.example.com.

A wildcard, certificates and typos

A wildcard in the DNS only says where a name points. Keep two things in mind:

• A certificate. For https on every subdomain, you need a certificate that covers those names. A wildcard certificate (*.example.com) is different from a wildcard record, and is requested separately. Let's Encrypt only issues wildcard certificates via a check in the DNS.
• Typos. With a wildcard, ww.example.com or wwww.example.com also work. This can be handy, but it also means that any conceivable name gives an answer. Some administrators specifically don't want that.

In practice: what it looks like in a panel

As an example, we'll use DirectAdmin. Other panels (cPanel, Plesk) have a similar screen for subdomains.

1. Open Subdomain Management and click Add Subdomain.
2. Type only the first part, for example shop.
3. Choose the folder for the files, or leave the default.
4. Save.

If you want the subdomain to point to an external service, skip this screen and just create a record in DNS Administration (lesson 3.1 or 3.2).

Summary

• A subdomain comes into being when you create a record for it; registration isn't needed.
• Just a DNS record is enough if an external service provides the website. You need a subdomain in the hosting panel if the site is hosted on your own hosting account.
• A wildcard *.example.com answers for all names that don't otherwise exist.
• An existing name always wins over the wildcard; the wildcard doesn't apply to the bare domain, and not under a name that exists.
• A wildcard record isn't a wildcard certificate.

Quiz

Exercise

Exercise Z3.3: Discovering a wildcard. Find out whether github.io uses a wildcard. Look up the A record of a name that almost certainly doesn't exist separately, such as dnscursus- followed by a few random letters .github.io. If you get an IP address back, enter yes along with the address you received.

Exercise O3.3: Setting it up yourself in your practice zone. In your practice zone, create:

• a wildcard record * (type A) with the value 192.0.2.20
• an A record vast with the value 192.0.2.21

The program will then check three names: a random name (which should give the wildcard's result), vast (which should give its own address) and the bare practice zone.

Further reading

These articles describe the steps in WebOké's panels; in other panels the process is similar.

• DirectAdmin guide 4.5: Creating and deleting subdomains
• Creating a subdomain, and what to do if it doesn't work
• Can I use subdomains with a wildcard (*.yourdomain.com)?
• DirectAdmin guide 6.3: Certificate for www, subdomains and wildcard