One record that answers for names you have not even thought of yet — that is the wildcard's promise, and it is real. It is also a record that quietly changes how your whole domain behaves, so it deserves an honest page of its own.
A normal record answers for one exact name. A wildcard record — written with a star, like *.example.com — answers for every first-level subdomain that does not have its own record. Type anything.example.com, random-words.example.com, a name you invented this second: the wildcard answers for all of them, pointing them all at one place. Cloudflare's documentation confirms customers on all plans, including free, can create and proxy wildcard records. Two precision points before the risks: the star only works as the first label (you cannot wildcard the middle of a name), and any specific record always beats the wildcard — create a record for mail and the wildcard politely steps aside for that name.
customer1, customer2...) cannot pre-create thousands of records; a wildcard plus an app that reads the name is the standard designIf none of these sound like you, you probably do not need a wildcard — three hand-made records are clearer than one catch-all.
The wildcard cannot tell a name you wanted from a name a stranger typed. paypa1.example.com, login-secure.example.com — if someone links to them, they resolve to your server wearing your domain. On a lone website this is mostly harmless (your server shows the same site for every name), but understand what you have done: you have removed DNS as a filter. Your server and its configuration now decide everything, so the server must be set to respond sensibly to unknown names — ideally one default site, never your admin panel.
example.com and *.example.com — so wildcard first-level names are covered, goodapp.test.example.com are not covered by the free Universal certificate — visitors can hit certificate errors on names you never deliberately createdWithout a wildcard, a forgotten record announces itself instantly: the name does not resolve, you notice, you fix it. With a wildcard, every mistake silently “works” — the traffic lands on the default server, the wrong content loads, and the real problem (a missing record, a service pointing nowhere) is masked for weeks. Teams add wildcards and then debug ghosts. If you keep one, keep a written list of the names you actually depend on, and give each a specific record — the wildcard should be a safety net, not the whole floor.
The video covers the DNS records screen in depth — the same screen where a wildcard record would be added.
▶️ Watch Full VideoYes. Cloudflare's own documentation says customers on all plans can create and proxy wildcard DNS records. The star must be the first label of the name, like *.example.com.
Because a specific record always wins over the wildcard. If mail.example.com has its own record, that record — not the wildcard — decides where mail goes. Check the DNS list for a specific record with that name.
The wildcard matches one level: names directly under your domain. Deeper names are not caught by *.example.com, and the free Universal SSL does not cover them either. Deep naming needs its own records and, on Cloudflare, paid certificate options.