How to Set Up Wildcard Subdomains in Namecheap DNS

Manually creating DNS records every time a customer registers a workspace or your CI/CD spins up a preview environment gets old fast. If you’re building a multi-tenant app where users get their own custom subdomains like acme.yourdomain.com, you need a wildcard DNS record so any arbitrary subdomain routes straight to your server.

Here’s how I set up wildcard DNS in Namecheap, verify propagation via CLI, configure Nginx and Caddy catch-all blocks, and issue wildcard SSL certificates with Let’s Encrypt.

How Wildcard DNS Resolution Works in Practice

A wildcard DNS record uses an asterisk (*) as the hostname. It serves as a catch-all fallback for any subdomain you haven’t explicitly defined in your zone file.

DNS resolution follows RFC 1034 rules, checking for exact matches before hitting wildcards:

• If you already have an explicit record for api.yourdomain.com, requests for api go directly to that specific target.
• If someone requests random-tenant.yourdomain.com and no explicit record exists, the resolver falls back to the * wildcard.
• Standard DNS wildcards only cover one subdomain depth level. A record for *.yourdomain.com matches app.yourdomain.com and client1.yourdomain.com, but it won’t catch nested subdomains like sub.app.yourdomain.com.

If you need deeper multi-tier routing, check out our guide on how to route subdomains to different servers in Namecheap DNS to set up explicit sub-zone delegations.

Step 1: Add the Wildcard Record in Namecheap DNS

Make sure your domain is actually using Namecheap BasicDNS, Web Hosting DNS, or PremiumDNS. If you delegated your domain to third-party nameservers like Cloudflare or AWS Route 53, you’ll need to create this wildcard on their end instead.

1. Log in to your Namecheap Dashboard.
2. Head to Domain List in the left sidebar and hit Manage next to your domain.
3. Open the Advanced DNS tab.
4. Scroll down to Host Records and click Add New Record.

Pick either an A Record or a CNAME Record depending on your setup:

• Option A (Direct Server IP): Set Type to A Record, Host to *, Value to your server’s public IPv4 (like 198.51.100.25), and TTL to 1 min while setting things up.
• Option B (PaaS / Load Balancer Target): Set Type to CNAME Record, Host to *, and Target to your destination hostname (like app-cluster.ingress.yourdomain.com.).

If you’re pairing a wildcard with an apex domain record, be mindful of how apex routing behaves. See our breakdown on pointing the root domain in Namecheap DNS with A vs CNAME records to avoid apex conflict gotchas.

Click the green checkmark to save. Namecheap’s BasicDNS changes usually take anywhere from 2 to 15 minutes to kick in.

Step 2: Verify DNS Propagation from the Command Line

Don’t rely on your browser to test wildcard routing—browser and OS caches will trick you every time. Query your upstream DNS resolvers directly with dig or nslookup.

Run these in your terminal with a few random subdomain names:

# Query Google Public DNS for a random dynamic tenant
dig +short tenant-alpha.yourdomain.com @8.8.8.8 # Query Cloudflare DNS for a secondary random tenant
dig +short staging-test-99.yourdomain.com @1.1.1.1 # Check authorative responses from Namecheap nameservers directly
dig +short random123.yourdomain.com @dns1.registrar-servers.com

If your wildcard A record points to 198.51.100.25, all three queries should return that exact IP. If you get NXDOMAIN or nothing back, double-check your Namecheap records to make sure there are no trailing spaces around the * character in the Host field.

Step 3: Configure Server Catch-Alls (Nginx & Caddy)

Once Namecheap routes all incoming traffic to your IP, your web server has to know what to do with dynamic hostnames instead of dropping them on the floor.

Nginx Wildcard Virtual Host

In your Nginx site configuration (usually /etc/nginx/sites-available/yourdomain.conf), add the wildcard pattern to server_name:

server { listen 80; listen [::]:80; server_name yourdomain.com *.yourdomain.com; # Optional: Extract the tenant slug from the Host header set $tenant_id "default"; if ($host ~* ^([a-z0-9-]+).yourdomain.com$) { set $tenant_id $1; } location / { proxy_pass http://127.0.0.1:3000; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Tenant-ID $tenant_id; }
}

Test the syntax and reload Nginx:

sudo nginx -t && sudo systemctl reload nginx

For more details on how host matching works, take a look at the official Nginx server_names documentation.

Caddy Wildcard Configuration

If you’re using Caddy, set up wildcard matching and reverse proxying directly in your Caddyfile:

*.yourdomain.com, yourdomain.com { reverse_proxy 127.0.0.1:3000 { header_up Host {host} header_up X-Real-IP {remote_host} }
}

Step 4: Issue Wildcard SSL with Let’s Encrypt (DNS-01 Challenge)

Standard HTTP-01 challenges (port 80 file verification) don’t work for wildcard certs. Let’s Encrypt requires a DNS-01 challenge to prove you actually control the entire DNS zone.

As outlined in the Let’s Encrypt Challenge Types documentation, validating a wildcard like *.yourdomain.com requires creating a _acme-challenge TXT record in your DNS zone.

Run Certbot in manual mode to start the process:

sudo certbot certonly  --manual  --preferred-challenges=dns  -d "yourdomain.com"  -d "*.yourdomain.com"

Certbot will spit out a validation string and pause:

Please deploy a DNS TXT record under the name:
_acme-challenge.yourdomain.com
with the following value:
9kXyA6Z_EXAMPLE_TOKEN_L4m0PqRtUvWxYz12345678

Now jump back to Namecheap to create the validation record:

1. Open your Namecheap Advanced DNS tab.
2. Click Add New Record and select TXT Record.
3. In Host, enter _acme-challenge (Namecheap automatically handles the root domain part).
4. In Value, paste the hash string Certbot gave you.
5. Set the TTL to 1 min and save.

Before hitting Enter in your Certbot terminal, make sure public resolvers can actually see the TXT record:

dig +short TXT _acme-challenge.yourdomain.com @8.8.8.8

Once dig returns the challenge hash, press Enter in Certbot. It’ll verify the record and save the certificate files to /etc/letsencrypt/live/yourdomain.com/.

Now update your Nginx config to serve traffic over SSL on port 443:

server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name yourdomain.com *.yourdomain.com; ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; }
}

If you’re deploying on a VPS or paired hosting stack, check out our guide on deploying a web app with Namecheap DNS and SSL.

Handling Dynamic Routing Inside Your Application

Once traffic reaches your backend, grab the incoming Host header to figure out which tenant database or view needs to render.

Here’s a quick Express middleware example that parses wildcard subdomains:

const express = require('express');
const app = express(); const ROOT_DOMAIN = 'yourdomain.com'; app.use((req, res, next) => { const hostname = req.hostname; if (hostname === ROOT_DOMAIN || hostname === `www.${ROOT_DOMAIN}`) { req.tenant = null; return next(); } if (hostname.endsWith(`.${ROOT_DOMAIN}`)) { const tenantSubdomain = hostname.replace(`.${ROOT_DOMAIN}`, ''); req.tenant = tenantSubdomain.toLowerCase(); return next(); } req.tenant = null; next();
}); app.get('/', (req, res) => { if (!req.tenant) { return res.send('Welcome to the Main Marketing Site'); } res.json({ status: 'success', tenant: req.tenant, message: `Displaying dashboard for workspace: ${req.tenant}` });
}); app.listen(3000, () => { console.log('App server listening on port 3000');
});

Gotchas and Troubleshooting

A few DNS quirks often trip people up when configuring wildcards.

1. Email Routing Interference

Wildcard records can interfere with email delivery if you have catch-all MX records. When an incoming mail server routes an email addressed to user@anything.yourdomain.com, an unmanaged wildcard can misdirect it.

To keep email services happy while setting up web wildcards, take a look at our guide on pointing Namecheap DNS without breaking email delivery.

2. Multi-Level Subdomains Do Not Match

A *.yourdomain.com record catches demo.yourdomain.com. It will never catch api.demo.yourdomain.com. If you need nested routing, you must create an explicit wildcard record for each layer:

• Host: *.demo → matches alpha.demo.yourdomain.com
• Host: *.staging → matches app.staging.yourdomain.com

3. Explicit Records Always Override Wildcards

If you already have a CNAME for docs.yourdomain.com pointing to an external documentation platform, Namecheap will always prioritize that specific record. The wildcard only kicks in when no exact match exists.

For more details on Namecheap’s record evaluation, check the Namecheap Wildcard Subdomain Knowledgebase.

Frequently Asked Questions

Can I use a wildcard CNAME record in Namecheap?

Yes. Set the Host field to * and the Value field to your target domain (like an AWS ALB or Heroku app slug). Add a trailing dot if your DNS provider requires fully qualified domain names.

Does Namecheap charge extra for wildcard DNS records?

No. Wildcard A, AAAA, and CNAME records are standard DNS features included for free with Namecheap BasicDNS, Web Hosting DNS, and PremiumDNS.

Can I automate Let’s Encrypt certificate renewals for wildcards?

Yes. Instead of using the manual challenge each time, use a Certbot DNS plugin (like certbot-dns-namecheap, or Cloudflare DNS if you use Cloudflare nameservers) to automatically create and clean up TXT challenge records via API.

How long does it take for a wildcard record to activate?

On Namecheap BasicDNS, changes typically show up across upstream resolvers in 2 to 15 minutes. Keeping your TTL at 1 minute while testing keeps cached lookups from getting in your way.

Next Steps for Your Infrastructure

With your wildcard DNS live in Namecheap, requests route to your app and get secured by SSL. If your architecture expands across multiple server clusters or regions, check out our guide on how to route subdomains to different servers in Namecheap DNS to isolate high-traffic services from your main tenant app.