DNS records do not use wildcard entries

​

What this check verifies

Cloudflare DNS records are assessed for wildcard usage by checking if A, AAAA, CNAME, MX, or SRV records use wildcard entries (*.example.com) which can increase attack surface, expose unintended services, or allow mail interception.

​

Risk

Wildcard DNS records can expose unintended services and increase attack surface.

• Confidentiality: any subdomain resolves, potentially exposing internal naming conventions; wildcard MX allows mail interception
• Integrity: attackers can access unintended services via arbitrary subdomains
• Availability: wildcard records may route traffic or services not designed for public access

​

Recommendation

Avoid using wildcard DNS records unless absolutely necessary.

• Use specific subdomain records instead of wildcards
• If wildcards are required, ensure the target service handles unknown subdomains securely
• Document the business justification for any wildcard records
• Combine with proper web server configuration to reject unknown hosts

​

Remediation

Dashboard steps

1. Log in to the Cloudflare dashboard and select your account and domain
2. Go to DNS > Records
3. Identify wildcard DNS records (starting with *.)
4. Evaluate if the wildcard is necessary for your use case
5. Replace wildcard records with specific subdomain records where possible

​

References

• https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/

​

Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = dns_record_no_wildcard. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Cloudflare checks