Wildcard DNS proxying now open to all Cloudflare plans

Cloudflare has removed the Enterprise-only restriction on proxying wildcard DNS records. The capability is now available across all plan levels, including free and pay-as-you-go accounts.

What wildcard DNS records do

A standard DNS record maps a single name to one or more targets, such as IP addresses. If you have hundreds of subdomains that should all resolve to the same resource, maintaining individual records for each one becomes impractical. A wildcard record solves this by using an asterisk ("*") in the Name field to match any subdomain that is not already covered by a more specific record.

For example, a wildcard on *.mycoolwebpage.xyz responds to queries for any subdomain of mycoolwebpage.xyz that lacks its own dedicated record. The wildcard also matches deeper levels, so deeper.label.subdomain2.mycoolwebpage.xyz is caught by the wildcard when no explicit record exists below that path. Wildcards are not applicable at the zone apex itself.

Wildcard behavior rules

  • Wildcards are only supported on the first label. A name like subdomain.*.mycoolwebpage.xyz is not treated as a wildcard; the asterisk is interpreted as a literal character.
  • Multiple wildcard levels are not supported. In *.*.mycoolwebpage.xyz, only the first asterisk functions as a wildcard; the second is literal.
  • Wildcards cover multiple levels but terminate at explicit records. Any specific record — regardless of type — on a given label stops wildcard matching for that label and everything below it. For instance, with only a wildcard and a record on subdomain1.mycoolwebpage.xyz, queries for deeper.label.subdomain1.mycoolwebpage.xyz are not covered by the wildcard, while deeper.label.subdomain2.mycoolwebpage.xyz still is. The existence of any branch terminates wildcard application for all records on that branch, even if the existing record is of a different type or sits at a deeper level.
  • Wildcards apply only to the record type specified. A wildcard A record does not answer AAAA queries, though a specific record on a label will still terminate the wildcard for that branch regardless of type.

The full specification for wildcard behavior is documented in RFC4592.

Proxying wildcard records

Proxying works for DNS record types A, AAAA, and CNAME, which point a hostname to an origin server expecting HTTP/S traffic. Enabling the proxy on a wildcard record behaves the same way as on a specific record: in the Cloudflare dashboard, create or edit the record and toggle the proxy status to Proxied. Cloudflare nameservers then return two Cloudflare anycast IPs instead of the origin IPs, routing all matching HTTP/S traffic through Cloudflare’s network.

The default TLS certificate setup covers the zone apex and all subdomains on the next level, such as mycoolwebpage.xyz and *.mycoolwebpage.xyz. For deeper wildcards like *.www.mycoolwebpage.xyz, you can subscribe to Cloudflare Advanced Certificate Manager to obtain a certificate covering that wildcard level.

If you are not yet using Cloudflare DNS for your domain, migration from an existing DNS provider is straightforward. Instructions for changing your authoritative nameservers are available in the developer documentation.