{"record":{"id":"8c07665f4ac2c5a4","repo":"projectdiscovery/subfinder","slug":"s-is-not-a-wildcard-domain","errorCode":null,"errorMessage":"%s is not a wildcard domain","messagePattern":"(.+?) is not a wildcard domain","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/resolve/resolve.go","lineNumber":83,"sourceCode":"\t\tfor range workers {\n\t\t\tresolutionPool.wg.Add(1)\n\t\t\tgo resolutionPool.resolveWorker()\n\t\t}\n\t\tresolutionPool.wg.Wait()\n\t\tclose(resolutionPool.Results)\n\t}()\n\n\treturn resolutionPool\n}\n\n// InitWildcards inits the wildcard ips array\nfunc (r *ResolutionPool) InitWildcards(domain string) error {\n\tfor range maxWildcardChecks {\n\t\tuid := xid.New().String()\n\n\t\thosts, _ := r.DNSClient.Lookup(uid + \".\" + domain)\n\t\tif len(hosts) == 0 {\n\t\t\treturn fmt.Errorf(\"%s is not a wildcard domain\", domain)\n\t\t}\n\n\t\t// Append all wildcard ips found for domains\n\t\tfor _, host := range hosts {\n\t\t\tr.wildcardIPs[host] = struct{}{}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (r *ResolutionPool) resolveWorker() {\n\tfor task := range r.Tasks {\n\t\tif !r.removeWildcard {\n\t\t\tr.Results <- Result{Type: Subdomain, Host: task.Host, IP: \"\", Source: task.Source, WildcardCertificate: task.WildcardCertificate}\n\t\t\tcontinue\n\t\t}\n\n\t\thosts, err := r.DNSClient.Lookup(task.Host)","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/projectdiscovery/subfinder/blob/7a0b91f0fac01b62c65328bd771a3560ae611d6a/pkg/resolve/resolve.go#L65-L101","documentation":"InitWildcards probes a domain for wildcard DNS by resolving a random subdomain (xid-based UID + '.' + domain). If a random subdomain resolves to zero hosts, the domain cannot be a wildcard domain, so the function aborts with this error. It is a guard against treating non-wildcard domains as wildcards during enumeration.","triggerScenarios":"Calling ResolutionPool.InitWildcards(domain) (directly or via EnumerateSingleDomainWithCtx) when the DNS lookup of '<random-uid>.<domain>' returns no A records — i.e. NXDOMAIN/NODATA for random subdomains.","commonSituations":"Running enumeration against a domain that genuinely has no wildcard DNS record; misconfigured or blocked DNS resolvers returning empty answers; passing a typo'd or non-existent domain to the wildcard check.","solutions":["Verify the domain has valid DNS and resolves normally before enabling wildcard handling","Check that r.DNSClient is configured with working resolvers (no firewall/VPN blocking queries)","Only call InitWildcards when wildcard detection is actually needed; treat the error as 'domain is not wildcard', not a fatal failure","Retry once in case of a transient DNS failure before giving up"],"exampleFix":"// before\nif err := pool.InitWildcards(domain); err != nil {\n    return err\n}\n// after\nif err := pool.InitWildcards(domain); err != nil {\n    gologger.Debug().Msgf(\"%s: no wildcard detected (%v); continuing\", domain, err)\n}","handlingStrategy":"validation","validationCode":"ips, err := net.LookupHost(fmt.Sprintf(\"%s.%s\", randomToken, domain))\nif err == nil && len(ips) > 0 {\n    // domain likely wildcard; safe to call InitWildcards\n}","typeGuard":"func isWildcardCapable(domain string) bool {\n    if net.ParseIP(domain) != nil {\n        return false\n    }\n    return strings.Contains(domain, \".\")\n}","tryCatchPattern":null,"preventionTips":["Verify the domain resolves before enabling wildcard handling","Check DNS client configuration (resolvers, VPN/firewall)","Treat this error as informational, not fatal, in pipelines"],"tags":["dns","wildcard","reconnaissance"],"backgroundTag":"empty-result-set","analyzedSha":"7a0b91f0fac01b62c65328bd771a3560ae611d6a","analyzedAt":"2026-09-06T23:52:02.109Z","contentChangedAt":"2026-09-06T23:52:02.109Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}