wildcard
Click on the red underlined text to get to the source
... resource records (RRs) called
wildcards. The definition in RFC 1034std13 is incomplete and has proven
to be confusing. This document describes the wildcard ...
... wildcards. The definition in RFC 1034std13 is incomplete and has proven
to be confusing. This document describes the wildcard synthesis by
adding to the discussion and making limited modifications.
...
... document avoids specifying rules for DNS implementations regarding
wildcards. The intention is to only describe what is needed for
interoperability, not restrict implementation choices. In addition,
...
... 1034std13's definition.
This document is focused on the concept of wildcards as defined in
RFC 1034std13. Nothing is implied regarding alternative means of
...
... Many DNS implementations diverge, in different ways, from the
original definition of wildcards. Although there is clearly a need
to clarify the original documents in light of this alone, the impetus
for this document lay in the engineering of the DNS security
extensions ...
... for this document lay in the engineering of the DNS security
extensions [RFC4033]. With an unclear definition of wildcards, the
design of authenticated denial became entangled.
...
... remain as close to the original document as possible. To reinforce
that this document is meant to clarify and adjust and not redefine
wildcards, relevant sections of RFC 1034std13 are repeated verbatim to
facilitate comparison ...
...
The definition of the wildcard concept is comprised by the
documentation of the algorithm by which a name server ...
... data (section 4.3.3).
This is the definition of the term "wildcard" as it appears in RFC
1034std13, section 4.3.3.
...
... starting with the label "*". Such RRs are called
# wildcards. Wildcard RRs can be thought of as instructions for
...
... RRs are called
# wildcards. Wildcard RRs can be thought of as instructions for
# synthesizing RRs ...
...
This passage follows the algorithm in which the term wildcard is
first used. In this definition, wildcard refers to resource records ...
... algorithm in which the term wildcard is
first used. In this definition, wildcard refers to resource records.
In other usage, wildcard ...
... wildcard refers to resource records.
In other usage, wildcard has referred to domain names, and it has
been used to describe the operational practice of relying on
...
... domain names, and it has
been used to describe the operational practice of relying on
wildcards to generate answers. It is clear from this that there is a
need to define clear and unambiguous terminology in the process of
discussing wildcards ...
... wildcards to generate answers. It is clear from this that there is a
need to define clear and unambiguous terminology in the process of
discussing wildcards.
The mention of the use of wildcards ...
... wildcards.
The mention of the use of wildcards in the preparation of a response
is contained in step 3, part 'c' of RFC 1034std13's section 4.3.2,
...
... 1034std13's section 4.3.2,
entitled "Algorithm". Note that "wildcard" does not appear in the
algorithm, instead references are made to the "*" label. The portion
...
... algorithm, instead references are made to the "*" label. The portion
of the algorithm relating to wildcards is deconstructed in detail in
section 3 of this document; this is the beginning of the relevant
portion of the "Algorithm ...
...
The scope of this document is the RFC 1034std13 definition of wildcards
and the implications of updates to those documents, such as DNS
Security (DNSSEC ...
...
o Describes the actions of certain resource records as wildcards
...
...
To help in discussing what resource records are wildcards, two terms
will be defined: "asterisk label" and "wildcard domain name ...
... resource records are wildcards, two terms
will be defined: "asterisk label" and "wildcard domain name". These
are defined in section 2.1.1.
...
...
The new terms are used to make discussions of wildcards clearer.
Terminology does not directly have an impact on implementations.
...
... RFC 1034std13, section 4.3.3, seems to prohibit having two asterisk labels
in a wildcard owner name. With this document, the restriction is
removed entirely. This change and its implications are in section
...
...
This document describes semantics of wildcard RRSets for
"interesting" types as well as empty non-terminal wildcards ...
... wildcard RRSets for
"interesting" types as well as empty non-terminal wildcards.
Understanding these situations in the context of wildcards ...
... wildcards.
Understanding these situations in the context of wildcards has been
clouded because these types incur special processing if they are the
result of an exact match. This discussion ...
... Wildcard Syntax ...
...
The syntax of a wildcard is the same as any other DNS resource
record, across all classes and types. The only significant feature
...
... is the owner name.
Because wildcards are encoded as resource records with special names,
they are included in zone transfers and incremental zone transfers ...
... incremental zone transfers
[RFC1995] just as non-wildcard resource records are. This feature
has been under appreciated until discussions ...
... has been under appreciated until discussions on alternative
approaches to wildcards appeared on mailing lists.
...
... Identifying a Wildcard ...
...
To provide a more accurate description of wildcards, the definition
has to start with a discussion ...
... discussion of the domain names that appear as
owners. Two new terms are needed, "asterisk label" and "wildcard
domain name".
...
... Wildcard Domain Name and Asterisk Label ...
...
A "wildcard domain name" is defined by having its initial (i.e.,
leftmost or least significant) label be, in binary format ...
...
No label values other than that in section 2.1.1 are asterisk labels,
hence names beginning with other labels are never wildcard domain
names. Labels such as 'the*' and '**' are not asterisk labels, so
these labels do not start ...
... domain
names. Labels such as 'the*' and '**' are not asterisk labels, so
these labels do not start wildcard domain names.
...
... In section 4.3.3, the following is stated:
# .......................... The owner name of the wildcard RRs is
# of the form "*.<anydomain>", where <anydomain> is any domain name ...
... There are three possible reasons for putting the restriction in
place, but none of the three has held up over time. One is that the
restriction meant that there would never be subdomains of wildcard
domain names, but the restriction as stated still permits
...
... domain names, but the restriction as stated still permits
"example.*.example." for instance. Another is that wildcard domain
names are not intended to be empty non-terminals, but this situation
...
... terminals, but this situation
does not disrupt the algorithm in 4.3.2. Finally, "nested" wildcard
domain names are not ambiguous once the concept of the closest
...
... encloser had been documented.
A wildcard domain name can have subdomains. There is no need to
inspect the subdomains to see if there is another asterisk label in
...
... The notion that a domain name 'exists' is mentioned in the definition
of wildcards. In section 4.3.3 of RFC 1034std13:
...
...
"Existence" is therefore an important concept in the understanding of
wildcards. Unfortunately, the definition of what exists, in RFC
1034std13, is unclear. So, in sections 2.2.2. and 2.2.3, another look is
...
... example. 3600 NS ns.example.net.
*.example. 3600 TXT "this is a wildcard"
*.example. 3600 MX 10 host1.example.
sub.*.example. 3600 TXT "this is not a wildcard ...
... wildcard"
*.example. 3600 MX 10 host1.example.
sub.*.example. 3600 TXT "this is not a wildcard"
host1.example. 3600 A 192.0.2.1
_ssh._tcp.host1.example. 3600 SRV ...
...
The following responses would be synthesized from one of the
wildcards in the zone:
QNAME=host3.example. QTYPE=MX, QCLASS=IN ...
... the answer will be "foo.bar.example. IN TXT ..."
because bar.example. does not exist, but the wildcard
does.
...
...
The following responses would not be synthesized from any of the
wildcards in the zone:
QNAME=host1.example., QTYPE=MX, QCLASS=IN ...
...
The final example highlights one common misconception about
wildcards. A wildcard "blocks itself" in the sense that a wildcard
...
... The final example highlights one common misconception about
wildcards. A wildcard "blocks itself" in the sense that a wildcard
does not match its own subdomains. That is, "*.example." does not
...
... wildcards. A wildcard "blocks itself" in the sense that a wildcard
does not match its own subdomains. That is, "*.example." does not
match all names in the "example." zone; it fails to match the names
...
... match all names in the "example." zone; it fails to match the names
below "*.example.". To cover names under "*.example.", another
wildcard domain name is needed--"*.*.example."--which covers all but
its own subdomains.
...
... When Is a Wildcard Domain Name Not Special? ...
... algorithm is being followed.
When a wildcard domain name appears in the resource data of a record,
...
... Impact of a Wildcard Domain Name on a Response ...
...
RFC 1034std13's description of how wildcards impact response generation is
in its section 4.3.2. That passage contains the algorithm followed
...
... by a server in constructing a response. Within that algorithm, step
3, part 'c' defines the behavior of the wildcard.
The algorithm ...
... The closest encloser might be an empty non-terminal or even be a
wildcard domain name itself. In no circumstances is the closest
encloser to be used to synthesize records for the current query ...
... context of a query process
as that wildcard domain name immediately descending from the closest
encloser, provided that this wildcard ...
... wildcard domain name immediately descending from the closest
encloser, provided that this wildcard domain name exists.
"Immediately descending" means that the source of synthesis has a
...
... The important concept is that for any given lookup process, there is
at most one place at which wildcard synthetic records can be
obtained. If the source of synthesis does not exist, the lookup
...
...
Sections 2 and 3 of this document discuss wildcard synthesis with
respect to names in the domain tree ...
... domain tree and ignore the impact of types.
In this section, the implication of wildcards of specific types is
discussed. The types covered are those that have proven to be the
most difficult to understand. The types are SOA, NS ...
... closest encloser) and a zone apex is at the top of the zone.
Although a wildcard domain name owning an SOA RRSet can never be a
...
... As a result of these discussions, there is no definition given for
wildcard domain names owning an NS RRSet ...
... undefined until there is a clear need to have a set defined, and
until there is a clear direction to proceed. Operationally,
inclusion of wildcard NS RRSets in a zone is discouraged, but not
barred.
...
... as loading at the master server. The case of a client (resolver,
caching server) getting a wildcard of type NS in a reply would also
have to be considered.
...
... Given the daunting challenge of a complete definition of how to ban
such records, dealing with existing implementations that permit the
records today is a further complication. There are uses of wildcard
domain name owning NS ...
... NS RRSets.
One compromise proposed would have redefined wildcards of type NS to
not be used in synthesis, this compromise fell apart because it would
...
...
With no clear consensus forming on the solution to this dilemma, and
the realization that wildcards of type NS are a rarity in operations,
the best course of action is to leave this open-ended ...
... The issue of a CNAME RRSet owned by a wildcard domain name has
prompted a suggested change to the last paragraph of step 3c of the
...
... Ownership of a DNAME [RFC2672] RRSet by a wildcard domain name
represents a threat to the coherency of the DNS ...
...
Another justification for a recommendation to avoid the use of
wildcard DNAME records is the observation that such a record could
synthesize a DNAME owned by "sub.foo.bar.example." and
...
... that no domain exist below a DNAME-owning domain; hence, the wildcard
DNAME is to be avoided.
...
... the SRV RRSet, what remains could be a wildcard domain name but this
is immaterial to the SRV ...
... SRV 0 1 9 old-slow-box.example.
*.example is a wildcard domain name and although it is the Name of
the SRV RR ...
... domain name). The owner domain name
is "_foo._udp.*.example.", which is not a wildcard domain name.
...
... A DS RRSet owned by a wildcard domain name is meaningless and
harmless. This statement is made in the context ...
...
RRSIG records will be present at a wildcard domain name in a signed
zone and will be synthesized along with data sought in a query ...