projectdiscovery/subfinder · warning

is not a wildcard domain

Error message

%s is not a wildcard domain

What it means

InitWildcards probes a domain for wildcard DNS by resolving a random subdomain (xid-based UID + '.' + domain). If a random subdomain resolves to zero hosts, the domain cannot be a wildcard domain, so the function aborts with this error. It is a guard against treating non-wildcard domains as wildcards during enumeration.

Solutions

1. Verify the domain has valid DNS and resolves normally before enabling wildcard handling
2. Check that r.DNSClient is configured with working resolvers (no firewall/VPN blocking queries)
3. Only call InitWildcards when wildcard detection is actually needed; treat the error as 'domain is not wildcard', not a fatal failure
4. Retry once in case of a transient DNS failure before giving up

Example fix

// before
if err := pool.InitWildcards(domain); err != nil {
    return err
}
// after
if err := pool.InitWildcards(domain); err != nil {
    gologger.Debug().Msgf("%s: no wildcard detected (%v); continuing", domain, err)
}

ips, err := net.LookupHost(fmt.Sprintf("%s.%s", randomToken, domain))
if err == nil && len(ips) > 0 {
    // domain likely wildcard; safe to call InitWildcards
}

func isWildcardCapable(domain string) bool {
    if net.ParseIP(domain) != nil {
        return false
    }
    return strings.Contains(domain, ".")
}

When it happens

Trigger: Calling ResolutionPool.InitWildcards(domain) (directly or via EnumerateSingleDomainWithCtx) when the DNS lookup of '<random-uid>.<domain>' returns no A records — i.e. NXDOMAIN/NODATA for random subdomains.

Common situations: Running enumeration against a domain that genuinely has no wildcard DNS record; misconfigured or blocked DNS resolvers returning empty answers; passing a typo'd or non-existent domain to the wildcard check.

Understand the failure class

Background: EmptyResultError / "no results found": when an API or scraper succeeds but returns zero rows — this error's family across 9 libraries.

AI-assisted analysis of projectdiscovery/subfinder@7a0b91f0fa (2026-09-06). Data as JSON: /api/errors/8c07665f4ac2c5a4. Report an issue: GitHub.

Appendix: source

Thrown at pkg/resolve/resolve.go:83

		for range workers {
			resolutionPool.wg.Add(1)
			go resolutionPool.resolveWorker()
		}
		resolutionPool.wg.Wait()
		close(resolutionPool.Results)
	}()

	return resolutionPool
}

// InitWildcards inits the wildcard ips array
func (r *ResolutionPool) InitWildcards(domain string) error {
	for range maxWildcardChecks {
		uid := xid.New().String()

		hosts, _ := r.DNSClient.Lookup(uid + "." + domain)
		if len(hosts) == 0 {
			return fmt.Errorf("%s is not a wildcard domain", domain)
		}

		// Append all wildcard ips found for domains
		for _, host := range hosts {
			r.wildcardIPs[host] = struct{}{}
		}
	}
	return nil
}

func (r *ResolutionPool) resolveWorker() {
	for task := range r.Tasks {
		if !r.removeWildcard {
			r.Results <- Result{Type: Subdomain, Host: task.Host, IP: "", Source: task.Source, WildcardCertificate: task.WildcardCertificate}
			continue
		}

		hosts, err := r.DNSClient.Lookup(task.Host)

View on GitHub (pinned to 7a0b91f0fa)