14.2 Wildcards | DNS on Windows 2000


Team-Fly

	DNS on Windows 2000, 2nd Edition By Matt Larson, Cricket Liu
	Table of Contents

	Chapter 14. Miscellaneous

14.2 Wildcards

Something else we haven't covered yet is DNS wildcards . At times you want a single resource record to cover any possible name, rather than creating zillions of resource records that are all the same except for the domain name to which they apply. DNS reserves a special character, the asterisk (*), to be used in a DNS data file as a wildcard name. It will match any number of labels in a name, as long as it isn't an exact match with a name already in the DNS database.

Most often, you'd use wildcards to forward mail to non-Internet-connected networks. Suppose your site is not connected to the Internet, but you have a host that will relay mail between the Internet and your network. You could add a wildcard MX record to the movie.edu zone for Internet consumption that points all your mail to the relay. Here is an example:

 *.movie.edu.  IN  MX  10 movie-relay.nea.gov.

Since the wildcard matches one or more labels, this resource record would apply to names like terminator.movie.edu , empire.fx.movie.edu , or casablanca.bogart.classics.movie.edu . The danger with wildcards is that they clash with search lists. This wildcard also matches cujo.movie.edu.movie.edu , making wildcards dangerous to use in your internal zone data. Remember that some mailers apply the search list when looking up MX records:

 C:\>  nslookup  Default Server:  wormhole.movie.edu  Address:  192.249.249.1  >  set type=mx   -- Look up MX records  >  cujo.movie.edu   -- for cujo  Server:  wormhole.movie.edu  Address:  192.249.249.1  cujo.movie.edu.movie.edu  -- This isn't a real host's name!  preference = 10, mail exchanger = movie-relay.nea.gov

What are the limitations of wildcards? Wildcards do not match names for which there is already data. Suppose you did use wildcards within your zone data:

 *.movie.edu.   IN  MX  10 mail-hub.movie.edu.  et.movie.edu.  IN  MX  10 et.movie.edu.  jaws.movie.edu IN  A   192.253.253.113

Mail to terminator.movie.edu will be sent to mail-hub , but mail to et.movie.edu will be sent directly to et . An MX lookup of jaws.movie.edu would result in a response that says there is no MX data for that name. The wildcard doesn't apply because an A record exists. Can you use wildcards safely within your zone data? Yes. We'll cover that case a little later in this chapter.


Team-Fly

Top