| | Internet Architecture Board - IAB Documents |
 | | Properly speaking, a wildcard record's scope is limited to a single zone, since, by definition, a wildcard record never matches any name that really does exist in the zone, and thus will not match any (non-wildcard) delegation of a portion of the namespace from a parent zone to its child. |
 | | (Wildcard NS records, while theoretically possible, have sufficiently bizarre semantics that it is probably best to limit their use to torture-tests of DNS software.) So, at first blush, it would seem that the administrator of a zone is free to use wildcards without worrying about effects which this might have on the zone's delegated children. |
 | | We hesitate to recommend a flat prohibition against wildcards in "registry"-class zones, but strongly suggest that the burden of proof in such cases should be on the registry to demonstrate that their intended use of wildcards will not pose a threat to stable operation of the DNS or predictable behavior for applications and users. |
| www.iab.org /documents/docs/2003-09-20-dns-wildcards.html (3937 words) |