We have an A record that points
*.example.com to an IP address.
Is there a way to prevent 2nd level subdomains (
*.*.example.com) from being directed to that IP? Or direct them somewhere else?
No, or at least not immediately/simply.
RFC1034 says about wildcards:
The owner name of the wildcard RRs is of the form "
<anydomain>is any domain name.
<anydomain>should not contain other
*labels, and should be in the authoritative data of the zone.
So you can not enter something like
*.*.example.com in your DNS zone and expect it to work as a DNS wildcard (it will just be a record like others,
* is an authorized characters in labels).
Two possible paths that I see (but your question lacks precise details on what is behind the relevant IP in term of services):
foo.bar.example.comyou can respond differently than when receiving a query for
foo.example.com(that means you are not using standard DNS wildcards anymore).
foo.bar.example.comthan requests for
foo.example.com. In that case the DNS resolution and the IP result will be the same, all cases will come to your server but depending on what you do at level 7, you may then be able to filter the bad ones there.
Otherwise, if your list of domains at
*.example.com is small enough that you can manage them, for example you have the list:
quz then you can enter the following wildcards (while not exactly recommanded due to the IP used):
*.foo.example.com IN A 0.0.0.0 *.bar.example.com IN A 0.0.0.0 *.quz.example.com IN A 0.0.0.0
In addition to your existing
*.example.com wildcard with a specific correct IP address.