They answer names nobody created.
Ask an ordinary domain for totally-made-up-thing.example.com and the resolver says the name does not exist. Some domains answer anyway, for anything you can invent. We can see which ones, because the scanner was already asking every domain a question nobody else was.
The count is not being reported right now. The method below is unchanged, and every domain's own record still carries its reading.
Has a name nobody created ever answered for your domain?
This reads the signed record, so the answer is an observation with a date on it rather than a live guess.
How this was found, which was an accident
The scanner asks every domain in the index for a text record at _mcp._tcp.<domain>. That question was added to find AI service advertisements and is nearly useless for it: the convention is one we defined, and essentially nobody publishes it.
Which is exactly what makes it valuable. It asks for a name almost nobody registers, so it works as a control. A domain that returns something there, and what it returns is not the advertisement the name was meant to carry, is answering a name that was never created. That is wildcard DNS, and the reading rides a query we were already paying for on every scan. No extra request, no extra resolver traffic, and it runs across the whole index on the ordinary scan cadence.
Why it matters
Wildcard DNS clusters around domain parking, dynamic DNS and catch-all hosting. It is also a real attack surface: if every invented hostname resolves, then a hostname an attacker invents resolves too, which is the ground state for subdomain takeover and for phishing hosted under a name that looks legitimate.
- Subdomain takeover. The attack needs a name that resolves but points at infrastructure nobody is holding. A wildcard satisfies the first half for every name at once.
- Phishing under a name that looks right. A link reading
secure-login.a-company-you-know.comis far more persuasive than a lookalike domain, and under a wildcard that name resolves without anyone at the company creating it. - It hides what the estate actually is. Subdomain enumeration against a wildcard returns everything and therefore tells you nothing, which is why an inventory that ignores wildcards tends to overcount.
Not every one of these is a weakness
What this control detects directly is a wildcard TEXT record. Whether invented hostnames also resolve to an ADDRESS is a second question, and it is the one subdomain takeover and phishing actually need. Re-asking a random sample of 150 of these domains through an independent resolver, at a name generated on the spot: 149 answered again, and 128 of the 150 answered for address records too. The rest answer only for text, and some of those are the opposite of a weakness, because a wildcard record that refuses mail is a recommended way to stop subdomain spoofing.
So the reading is worth knowing about a domain and it is not, on its own, a finding against it. The examples below say which of the two each one is, because a page that collapsed them would be overstating one and missing the other.
This is evidence of wildcard behaviour, not a proven fact. It rests on one control name: a domain could legitimately serve a TXT record at exactly that name for an unrelated reason, and a wildcard that answers address records but not TXT records would not be caught here at all.
Read it as what it is: one piece of evidence pointing at wildcard behaviour, strong enough to be worth surfacing and not strong enough to state as a bare fact about somebody else's domain. Strengthening it across the whole index means asking a second, randomly generated control name on every scan, which costs a real resolver query across every domain we track. That is a deliberate decision and it has not been made. It IS made for the handful of domains this page names.
No stamp means no evidence. It is not a record that the domain has no wildcard, and it must never be read as one. A domain shows this reading only when a scan actually saw the control answered. A domain without it may have no wildcard, or may have one our single control name does not reach.
This is why no domain page carries a green "no wildcard DNS" line, and why the lookup above will not give you one. We do not have that observation, so we do not print it.
Why there is no share of the internet here
The figure above is a count, and the 24-hour figure beside it divides by the domains we asked in that window, not by the internet and not by the whole index. The distinction is the entire lesson: an early look at this reading suggested a very high share, drawn from domains that were in the sample because they had answered. That measured how the sample was built. A share is only meaningful with the population it is a share of, and it is named next to every figure on this page.
What to do about it on your own domain
- Find out whether it is deliberate. A wildcard is usually somebody's decision, sometimes years ago, and often nobody currently on the team made it.
- Separate the two cases. A wildcard text record that refuses mail is a hardening. A wildcard that resolves invented hostnames to an address is an inventory and takeover question.
- Watch it for change. The state that matters is not today's reading, it is the day it changes. Every reading here is signed at the moment it was taken, so the before and the after are both on the record.
This page describes a detection method, its limits, and what it has observed. A claim about a specific domain lives on that domain's record, with the date it was observed and the same qualifications stated above.