# Ensure DNS records do not use wildcard entries

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787214746684-ensure-dns-records-do-not-use-wildcard-entries
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the zone does not contain wildcard DNS records (records named \*), unless a specific wildcard is required and documented. Each subdomain should have its own explicit record, so only intended hostnames resolve.

**Rationale**

A wildcard record makes every possible subdomain resolve, including ones you never created. This can expose services unintentionally, makes it harder to know which hostnames are in use, and can help attackers with phishing or cookie-scoping attacks using convincing subdomains of your domain.

**Impact**

-   Only explicitly created subdomains resolve
    
-   Reduces unintended exposure of services
    
-   Subdomains that relied on the wildcard will stop resolving until explicit records are added
    

**Default Value**

By default, a zone has no wildcard records. They exist only if someone creates them.

**Pre-Requisites**

-   Cloudflare account with Administrator or DNS permissions for the zone
    
-   A list of subdomains that are actually in use
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Search the list for records whose Name is \* or starts with \*.
    
5.  If any wildcard record exists without a documented need, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Add explicit records for each subdomain that is really in use.
    
5.  Select Edit on the wildcard record, select Delete, and confirm.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Select Add record and re-create the wildcard record with its previous type, name, and content.
    

**Reference**

-   [https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/](https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.