Bulk wildcard DNS checker: which domains answer for names that don't exist?
In short: Paste domains and see which resolve made-up names such as sv-1a2b3c.acme.com, which means a wildcard record answers for every name, with what those names resolved to. Limit: Only A, AAAA and CNAME answers are tested. A wildcard on MX or TXT alone isn't found.
A bulk wildcard DNS checker tests many domains for a wildcard record in one run. Paste up to 100 domains, or 500 after a free Google sign-in. For each, two random names that were never created are asked for A, AAAA and CNAME records. If both resolve, a wildcard answers, and the row shows to what. DNS only. Download the results as CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
Two made-up names under acme.example both resolved, so a wildcard record answers there; globex.example has none.
- Domain
- acme.example
- Names queried
- 2 made-up
- Resolved to
- 203.0.113.7
What this means for you
A wildcard makes every hostname look alive, so a name that resolves proves little.
- Two random names per domain
- A, AAAA and CNAME tested
- Shows what they resolved to
- Names queried listed; CSV out
- Wildcard
- DNS
- *.domain
By SimpleVerifier Team · Last updated
Mapping the domains on a lead list?
- Paste the list here as domains or email addresses: up to 100 a run, or 500 after a free Google sign-in. Filter the rows and download the CSV.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check many domains for wildcard DNS?
- Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in. The domain is taken from each (www. is dropped).
- Press Check for wildcards. For each domain two random names under it are queried for A, AAAA and CNAME records, then the domain's own SOA, name servers and addresses, 15 domains a request.
- Read each row: Wildcard (with what the made-up names resolved to), No wildcard, Doesn't exist, or Lookup failed.
- Filter to wildcard domains and download the CSV, which lists the names queried.
Example
- You enter
- Three domains:
acme.example(a *.acme.example record),globex.example(no wildcard) andinitech.example(not registered). - You get
- acme.example: Wildcard, with the address the two made-up names resolved to. globex.example: No wildcard. initech.example: Doesn't exist. The CSV lists the names queried. Download it.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 15 domains a request; DNS only, A, AAAA and CNAME tested.
What is a wildcard DNS record?
A wildcard record is a DNS entry whose name starts with *, such as *.acme.com. RFC 4592 defines how it answers for any name below it that has no record of its own, so anything.acme.com resolves even though nobody created it. Sites use it for per-customer subdomains, to catch mistyped hostnames, or by accident.
This tool finds one by asking for names that can't exist. It generates two random labels of the form sv- and 12 hex characters under each domain, so a real record at those names is practically impossible, and asks for A, AAAA and CNAME records. If both names resolve, a wildcard is answering.
Why does a wildcard matter?
It makes every hostname look alive. A scan that guesses subdomains finds thousands of hits, a typo in a tracking or CNAME record still resolves instead of failing loudly, and an email link on a mistyped subdomain still loads a page. It also means a hostname resolving tells you nothing about whether a service is really set up there.
It isn't a fault: many platforms depend on it. The row shows what the made-up names resolved to, so you can see whether it points at the domain's own host or at a third party.
What can it miss?
Only A, AAAA and CNAME are tested. A wildcard that exists only for MX or TXT records isn't detected. Some DNS providers answer unknown names with their own redirect or parking address for domains you haven't configured, which can look like a wildcard; the row's answer helps tell the two apart.
To see the records at a name itself, use the bulk DNS lookup, and to follow a CNAME chain, the bulk CNAME lookup.
Who uses this tool, and for what?
- Security researchers
- Know which domains will make subdomain guessing return false positives.
- Email and cold email teams
- Check that tracking and sending domains don't hide a mistyped hostname behind a wildcard.
- Domain investors
- See which domains in a list already run a wildcard, which usually means they are in use.
- IT administrators
- Find wildcards left over from an old project across a portfolio.
What can’t this tool tell you?
- Only A, AAAA and CNAME answers are tested. A wildcard on MX or TXT alone isn't found.
- A DNS provider's own catch-all for unconfigured domains can look like a wildcard.
- Two probes per domain. A zone that answers some made-up names and not others can be missed.
- Public DNS can serve cached answers for up to the record's TTL.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check if a domain has a wildcard DNS record?
- Ask for a name that can't exist, such as a random string under the domain. If it resolves, a wildcard answers. A bulk wildcard DNS checker like this one does it for a whole list.
- Is this bulk wildcard checker free?
- Yes. It is a free tool: up to 100 domains a run with no account, and up to 500 a run when you sign in with Google, with no card.
- Does it connect to the domain's servers?
- No. It asks public DNS only. Nothing is sent to the websites or mail servers of the domains you paste.
- Can a wildcard record hurt email?
- A wildcard on A or CNAME records doesn't affect mail delivery, which uses MX records. It can hide typos in hostnames you use in links, such as tracking domains.
- Why does it say Doesn't exist?
- The domain itself has no SOA, name servers or address, so there is nothing to test. Check the spelling, or whether the domain has expired.
- Does it test subdomains such as mail.acme.com?
- It tests the registered domain. To test the names under a subdomain, paste the subdomain and the tool queries random names beneath it as written.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.