Yes, this works.


Yes, like Zoredache says, "this works".

There are some caveats though with wildcards that it's worth knowing:

  1. The wildcard matches one or more labels, so in your case foo.bar.domain.com will be matched by the wildcard, but bar.foo.domain.com will return NXDOMAIN because the presence of foo prevents any sub-domains of foo from matching

  2. The wildcard match is RRtype specific. However If the wildcard and override records don't have the same RRtype then the over-riding records will still "hide" the wildcard, but you get NODATA (i.e. no answer, rcode == NOERROR).

e.g.

$ORIGIN example.com.
*     IN A   192.168.1.1
foo   IN TXT "foo"

% dig @localhost foo.example.com. A
(abbreviated)
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36960
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0