Can the wildcard DNS record for 2nd level subdomains differ from the wildcard rule for 1st level subdomains?

Question

We have an A record that points *.example.com to an IP address.

Is there a way to prevent 2nd level subdomains (*.*.example.com) from being directed to that IP? Or direct them somewhere else?

Answer 1

No, or at least not immediately/simply.

RFC1034 says about wildcards:

The owner name of the wildcard RRs is of the form "*.<anydomain>", where <anydomain> is any domain name. <anydomain> should not contain other * labels, and should be in the authoritative data of the zone.

So you can not enter something like *.*.example.com in your DNS zone and expect it to work as a DNS wildcard (it will just be a record like others, * is an authorized characters in labels).

Two possible paths that I see (but your question lacks precise details on what is behind the relevant IP in term of services):

1. use a "dynamic" DNS server where you can plug some code or advanced resolution system, so that when you get a query for foo.bar.example.com you can respond differently than when receiving a query for foo.example.com (that means you are not using standard DNS wildcards anymore).
2. depending on what kind of service you have behind that IP, but multiple ones allow you a kind of "virtual hosting". Let us say you have a webserver, then you should be able to configure it so that it responds differently for requests with name foo.bar.example.com than requests for foo.example.com. In that case the DNS resolution and the IP result will be the same, all cases will come to your server but depending on what you do at level 7, you may then be able to filter the bad ones there.

Otherwise, if your list of domains at *.example.com is small enough that you can manage them, for example you have the list: foo, bar, quz then you can enter the following wildcards (while not exactly recommanded due to the IP used):

*.foo.example.com IN A 0.0.0.0
*.bar.example.com IN A 0.0.0.0
*.quz.example.com IN A 0.0.0.0

In addition to your existing *.example.com wildcard with a specific correct IP address.