Catching everything not otherwise specified.
WHAT THEY DO
A record for an asterisk matches any subdomain that has no specific record.
USEFUL WHEN
You have many subdomains pointing at the same place An application generates subdomains dynamically You want unspecified subdomains to resolve rather than fail
HOW IT BEHAVES
A specific record always wins. A wildcard only answers for names with no record of their own.
THE RISK
Every possible subdomain resolves, including ones you never created.
That can be used for phishing: someone crafting a convincing subdomain that resolves to your server.
It also means typographical errors resolve rather than failing visibly.
AT CLOUDFLARE
Wildcard records cannot be proxied on the free plan. They resolve directly to the origin.
FOR MAIL
A wildcard A record does not affect mail. MX records are separate.
WHETHER TO USE ONE
Only if you have a genuine reason. Explicit records for the subdomains you actually use are safer and clearer.
CHECKING
Look up a subdomain you never created. If it resolves, a wildcard exists.
