netbirdio/netbird · error

wildcards not allowed

Error message

wildcards not allowed

What it means

validateDomain rejects any nameserver match domain that starts with "*." before any other validation runs. Unlike DNS record names (IsValidDomain allows wildcards) and name-based network resources, nameserver match domains must be explicit domains, so wildcard subdomain matching is unavailable for nameserver groups.

Source

Thrown at management/server/nameserver.go:296

	}

	for _, id := range list {
		if id == "" {
			return status.Errorf(status.InvalidArgument, "group ID should not be empty string")
		}
		if _, found := groups[id]; !found {
			return status.Errorf(status.InvalidArgument, "group id %s not found", id)
		}
	}

	return nil
}

// validateDomain validates a nameserver match domain.
// Converts unicode to punycode. Wildcards are not allowed for nameservers.
func validateDomain(d string) error {
	if strings.HasPrefix(d, "*.") {
		return errors.New("wildcards not allowed")
	}

	// Nameservers allow trailing dot (FQDN format)
	toValidate := strings.TrimSuffix(d, ".")

	if _, err := nbdomain.ValidateDomains([]string{toValidate}); err != nil {
		return fmt.Errorf("%w: %w", errInvalidDomainName, err)
	}

	return nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. List the explicit domain instead, e.g. "example.com".
2. If several subdomains need the same nameservers, add each one (e.g. "a.example.com", "b.example.com") as separate match domains.
3. Request/track wildcard support upstream rather than working around the check, since the rejection is intentional.

Example fix

// before
nsGroup.Domains = []string{"*.example.com"}
// after
nsGroup.Domains = []string{"example.com", "a.example.com"}

for _, d := range nsGroup.Domains {
    if strings.HasPrefix(d, "*.") {
        return fmt.Errorf("wildcards are not allowed in nameserver match domains: %q", d)
    }
}

if err := am.SaveNameServerGroup(ctx, accountID, userID, nsGroup); err != nil {
    if err.Error() == "wildcards not allowed" {
        // strip the wildcard or enumerate subdomains explicitly
    }
    return err
}

When it happens

Trigger: SaveNameServerGroup with a domains entry like "*.example.com"; porting wildcard-style match domains from access-control or name-based resource configuration into a nameserver group.

Common situations: Users familiar with wildcard DNS matching try to route all subdomains of a zone through specific nameservers; migration from a DNS tool where wildcard forward zones are standard.

Related errors

• invalid domain name
• record name is required
• invalid record name format
• record type is required
• invalid CNAME target format

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/14a8a2f5bd497fef. Report an issue: GitHub.