When a domain answers a name nobody created.
Most domains answer for the names their operator published and refuse everything else. Ask an ordinary domain for totally-made-up-thing.example.com and the resolver says the name does not exist. A domain with wildcard DNS does the opposite: it has a rule that answers for anything under it, so every name you can invent resolves to something.
That is a normal, deliberate configuration in plenty of places. It is also a fact worth knowing about a domain, and almost nobody publishes it at internet scale.
Why it matters
Wildcard DNS clusters around domain parking, dynamic DNS and catch-all hosting. It is also a real attack surface: if every invented hostname resolves, then a hostname an attacker invents resolves too, which is the ground state for subdomain takeover and for phishing hosted under a name that looks legitimate.
- Subdomain takeover. The attack needs a name that resolves but points at infrastructure nobody is holding. A wildcard makes the first half free for every name at once.
- Phishing under a name that looks right. A link reading
secure-login.a-company-you-know.comis far more persuasive than a lookalike domain, and under a wildcard that name resolves without anyone at the company creating it. - It hides what the estate actually is. Subdomain enumeration against a wildcard returns everything and therefore tells you nothing, which is why an inventory that ignores wildcards tends to overcount.
How DomainDrift reads it
The scanner already asks every domain in the catalog for a TXT record at _mcp._tcp.<domain>. That question was added for a different purpose and is nearly useless for it, because the convention is one we defined and essentially nobody publishes it. What makes it valuable is precisely that nobody registers that name: it is a control. A domain that returns a TXT record there, and the record is not the advertisement the name was meant to carry, is answering a name that was never created.
So the reading is taken from a query the scanner already fires. No extra request, no extra DNS volume, and it runs across the whole catalog on the ordinary scan cadence. When a scan sees it, the observation is stamped on that domain and shown on its record.
This is evidence of wildcard behaviour, not a proven fact. It rests on one control name: a domain could legitimately serve a TXT record at exactly that name for an unrelated reason, and a wildcard that answers address records but not TXT records would not be caught here at all.
Read it as what it is: one piece of evidence pointing at wildcard behaviour, strong enough to be worth surfacing and not strong enough to state as a bare fact about somebody else's domain. Strengthening it means asking a second, randomly generated control name and requiring both to answer, which costs a real DNS query on every scan of a very large catalog. That is a deliberate decision, and it has not been made.
No stamp means no evidence. It is not a record that the domain has no wildcard, and it must never be read as one. A domain shows this block only when a scan actually saw the control answered. A domain without it may have no wildcard, or may have one our single control name does not reach.
This is why no domain page carries a green "no wildcard DNS" line. We do not have that observation, so we do not print it.
How common is it?
We are not publishing that number yet, and the reason is the more useful thing to say. The only sample taken so far was drawn from domains that had already answered the control, so it measures how the sample was built rather than how the internet is configured. A share is only meaningful with the population it is a share of, and the honest population here is not the catalog until a full sweep has asked every domain in it.
The sweep runs continuously. When it has covered the catalog, the figure belongs on this page with its population named next to it.
See it on a domain
Every domain in the catalog has a public record page.
Open any domain at /t/<domain>. If a scan has seen the control answered, the evidence block appears there with the date it was observed, alongside the rest of that domain's signed observation. Every underlying reading is Ed25519 signed at scan time and can be checked against its receipt.
This page describes a detection method and its limits. It makes no claim about any particular domain; a claim about a specific domain lives on that domain's record, with the date it was observed and the same qualifications stated above.