Wildcard DNS Detection

BIND Wildcard Control

BIND provides several approaches to secure wildcard DNS configurations. The most effective strategy involves removing wildcard records entirely and replacing them with explicit subdomain entries that you control.

Remove Dangerous Wildcards

Start by identifying and commenting out existing wildcard records in your zone files. This prevents attackers from creating arbitrary subdomains:

; Remove dangerous wildcard record - this allowed ANY subdomain to resolve
; *.example.com.    IN    A    192.168.1.100

Define Explicit Subdomains

Replace the wildcard with specific records for each legitimate subdomain. This approach gives you precise control over what resolves:

; Replace with specific subdomains - only these will resolve
www.example.com.     IN    A    192.168.1.100
api.example.com.     IN    A    192.168.1.101
mail.example.com.    IN    A    192.168.1.102

Implement Security Views

BIND views allow different DNS responses based on client location. This separates internal infrastructure from external exposure:

; Internal view - provides full DNS resolution for internal networks
view "internal" {
    match-clients { 192.168.0.0/16; 10.0.0.0/8; };
    zone "example.com" {
        type master;
        file "/etc/bind/zones/internal/example.com.zone";
    };
};

; External view - limited DNS exposure for public internet
view "external" {
    match-clients { any; };
    zone "example.com" {
        type master;
        file "/etc/bind/zones/external/example.com.zone";
    };
};

Security Benefit: Views prevent internal infrastructure exposure while maintaining necessary external services.

Unbound Wildcard Filtering

Unbound's filtering capabilities allow you to block suspicious wildcard abuse while maintaining legitimate DNS resolution. Configure these settings in /etc/unbound/unbound.conf to protect against common wildcard exploitation techniques.

Access Control for Suspicious Patterns

Set up access control tags to automatically refuse suspicious subdomain queries based on client location and pattern matching:

server:
    # Allow internal networks to access tagged suspicious subdomains
    access-control-tag-action: 192.168.0.0/16 allow suspicious_subdomains
    # Block external clients from accessing suspicious patterns
    access-control-tag-action: 0.0.0.0/0 refuse suspicious_subdomains

Local Zones for Abuse Prevention

Create static local zones that catch common wildcard abuse attempts and redirect them to safe endpoints:

    # Local zone to catch wildcard abuse - redirects to localhost
    local-zone: "suspicious.example.com" static
    local-data: "suspicious.example.com A 127.0.0.1"

Query Monitoring and Logging

Enable comprehensive logging to track wildcard queries and identify potential abuse patterns:

    # Log wildcard queries for monitoring suspicious activity
    log-queries: yes
    log-time-ascii: yes

Controlled Subdomain Resolution

Replace wildcards with specific local data entries that provide controlled resolution for legitimate subdomains:

    # Use local data to replace wildcards with specific subdomains
    local-zone: "api.example.com" transparent
    local-data: "api.example.com A 192.168.1.101"
    local-data: "www.example.com A 192.168.1.100"

Protection Advantage: This configuration blocks malicious wildcard abuse while allowing legitimate subdomain access with full logging visibility.

PowerDNS Wildcard Management

PowerDNS offers sophisticated Lua scripting capabilities to dynamically filter wildcard abuse attempts while maintaining database-driven DNS record management. This approach provides both real-time protection and permanent wildcard removal.

Lua Script for Dynamic Filtering

Implement a preresolve Lua script that examines each DNS query and blocks suspicious subdomain patterns before they can be exploited:

-- Lua script to block suspicious subdomains
function preresolve(dq)
    local qname = dq.qname:toString()
    
    -- Block IP-like subdomains (common in DNS rebinding attacks)
    if qname:match(".*%d+%-%d+%-%d+%-%d+%..*") then
        dq:addAnswer(pdns.A, "127.0.0.1")  -- Redirect to localhost
        return true
    end
    
    -- Block extremely long or random-looking subdomains
    if #qname > 50 or qname:match(".*[a-z0-9]{20,}%..*") then
        return true  -- Return NXDOMAIN for suspicious queries
    end
    
    return false  -- Allow normal queries to continue
end

This script blocks two common attack patterns: IP-address-like subdomains used in DNS rebinding attacks, and unusually long random subdomains that indicate reconnaissance or brute-force attempts.

Database Wildcard Replacement

Remove dangerous wildcard records from the PowerDNS database and replace them with specific, controlled subdomain entries:

-- Remove wildcard records that allow arbitrary subdomain resolution
DELETE FROM records WHERE name='*.example.com' AND type='A';

-- Add specific subdomain records for legitimate services only
INSERT INTO records (domain_id, name, type, content, ttl) 
VALUES (1, 'www.example.com', 'A', '192.168.1.100', 300);

INSERT INTO records (domain_id, name, type, content, ttl) 
VALUES (1, 'api.example.com', 'A', '192.168.1.101', 300);

Implementation Advantage: PowerDNS combines real-time Lua filtering with database-driven record management, providing both immediate protection and permanent wildcard elimination.

Cloudflare Wildcard Security

Cloudflare provides multiple layers of protection against wildcard DNS abuse through its dashboard controls and advanced Worker scripting capabilities. This combination offers both simple configuration options and sophisticated custom logic.

Dashboard Security Configuration

Start by accessing the DNS Records section in your Cloudflare dashboard where you can identify and replace dangerous wildcard entries. Navigate to DNS → Records and locate any asterisk (*) wildcard records that might be exposing your domain to abuse.

Replace these wildcards with specific subdomain records for each legitimate service you need to expose. This approach gives you precise control over which subdomains actually resolve while preventing attackers from creating arbitrary entries.

Configure Page Rules to control subdomain behavior by setting specific forwarding, caching, and security settings for different subdomain patterns. Enable Bot Management features to add an additional security layer that can detect and block automated subdomain scanning attempts.

Advanced Worker Script Protection

Deploy a Cloudflare Worker script that examines every incoming request and validates subdomain legitimacy before allowing access. This provides real-time protection against wildcard abuse attempts:

// Worker script to block suspicious subdomains
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const url = new URL(request.url)
  const hostname = url.hostname
  
  // Block suspicious patterns that indicate attack attempts
  if (hostname.match(/.*d+-d+-d+-d+..*/) ||  // IP-like subdomains
      hostname.match(/.*[a-z0-9]{20,}..*/) ||    // Random long strings
      hostname.length > 50) {                     // Excessively long hostnames
    return new Response('Access Denied', { status: 403 })
  }
  
  // Allow only explicitly whitelisted subdomains
  const allowedSubdomains = ['www', 'api', 'mail', 'admin']
  const subdomain = hostname.split('.')[0]
  
  if (!allowedSubdomains.includes(subdomain)) {
    return new Response('Subdomain Not Found', { status: 404 })
  }
  
  return fetch(request)  // Forward legitimate requests
}

This Worker script blocks common attack patterns including IP-address-like subdomains used in DNS rebinding attacks, random character strings that indicate scanning attempts, and any subdomain not explicitly allowlisted. The script runs on Cloudflare's edge network, providing global protection with minimal latency impact.

Cloudflare Advantage: Combines easy dashboard management with powerful edge computing protection, offering comprehensive wildcard security without complex server-side configuration.