{"record":{"id":"14a8a2f5bd497fef","repo":"netbirdio/netbird","slug":"wildcards-not-allowed","errorCode":null,"errorMessage":"wildcards not allowed","messagePattern":"wildcards not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"management/server/nameserver.go","lineNumber":296,"sourceCode":"\t}\n\n\tfor _, id := range list {\n\t\tif id == \"\" {\n\t\t\treturn status.Errorf(status.InvalidArgument, \"group ID should not be empty string\")\n\t\t}\n\t\tif _, found := groups[id]; !found {\n\t\t\treturn status.Errorf(status.InvalidArgument, \"group id %s not found\", id)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateDomain validates a nameserver match domain.\n// Converts unicode to punycode. Wildcards are not allowed for nameservers.\nfunc validateDomain(d string) error {\n\tif strings.HasPrefix(d, \"*.\") {\n\t\treturn errors.New(\"wildcards not allowed\")\n\t}\n\n\t// Nameservers allow trailing dot (FQDN format)\n\ttoValidate := strings.TrimSuffix(d, \".\")\n\n\tif _, err := nbdomain.ValidateDomains([]string{toValidate}); err != nil {\n\t\treturn fmt.Errorf(\"%w: %w\", errInvalidDomainName, err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":278,"sourceCodeEnd":308,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/server/nameserver.go#L278-L308","documentation":"validateDomain rejects any nameserver match domain that starts with \"*.\" before any other validation runs. Unlike DNS record names (IsValidDomain allows wildcards) and name-based network resources, nameserver match domains must be explicit domains, so wildcard subdomain matching is unavailable for nameserver groups.","triggerScenarios":"SaveNameServerGroup with a domains entry like \"*.example.com\"; porting wildcard-style match domains from access-control or name-based resource configuration into a nameserver group.","commonSituations":"Users familiar with wildcard DNS matching try to route all subdomains of a zone through specific nameservers; migration from a DNS tool where wildcard forward zones are standard.","solutions":["List the explicit domain instead, e.g. \"example.com\".","If several subdomains need the same nameservers, add each one (e.g. \"a.example.com\", \"b.example.com\") as separate match domains.","Request/track wildcard support upstream rather than working around the check, since the rejection is intentional."],"exampleFix":"// before\nnsGroup.Domains = []string{\"*.example.com\"}\n// after\nnsGroup.Domains = []string{\"example.com\", \"a.example.com\"}","handlingStrategy":"validation","validationCode":"for _, d := range nsGroup.Domains {\n    if strings.HasPrefix(d, \"*.\") {\n        return fmt.Errorf(\"wildcards are not allowed in nameserver match domains: %q\", d)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := am.SaveNameServerGroup(ctx, accountID, userID, nsGroup); err != nil {\n    if err.Error() == \"wildcards not allowed\" {\n        // strip the wildcard or enumerate subdomains explicitly\n    }\n    return err\n}","preventionTips":["Reject \"*.\" input in the UI for nameserver match domains with an explanatory message.","Enumerate the subdomains you actually need instead of copying wildcard patterns from other tools."],"tags":["dns","nameservers","validation","wildcard"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}