Description

Ensure the zone does not contain wildcard DNS records (records named *), unless a specific wildcard is required and documented. Each subdomain should have its own explicit record, so only intended hostnames resolve.

Rationale

A wildcard record makes every possible subdomain resolve, including ones you never created. This can expose services unintentionally, makes it harder to know which hostnames are in use, and can help attackers with phishing or cookie-scoping attacks using convincing subdomains of your domain.

Impact

  • Only explicitly created subdomains resolve

  • Reduces unintended exposure of services

  • Subdomains that relied on the wildcard will stop resolving until explicit records are added

Default Value

By default, a zone has no wildcard records. They exist only if someone creates them.

Pre-Requisites

  • Cloudflare account with Administrator or DNS permissions for the zone

  • A list of subdomains that are actually in use

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Search the list for records whose Name is * or starts with *.

  5. If any wildcard record exists without a documented need, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Add explicit records for each subdomain that is really in use.

  5. Select Edit on the wildcard record, select Delete, and confirm.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Select Add record and re-create the wildcard record with its previous type, name, and content.

Reference