Search... ⌘ K
Get Started Contact Sales

Change of Non-Compliant ENT Behavior

Last updated

Note

This change took effect on December 1, 2025. It only affected zones with an Empty Non-Terminal under a wildcard record, and affected customers were emailed before the change. For how ENTs work today, see What Are Empty Non-Terminals (ENT)?.

Table of Contents

On December 1, 2025, DNSimple changed how its name servers answer queries for Empty Non-Terminals (ENTs), to follow RFC 4592, Section 4.9. Customers had until November 30, 2025 to add any records they needed.

Since the change, DNSimple name servers answer an ENT query with NOERROR and an empty answer section (a NODATA response), instead of applying a wildcard record. This follows the DNS standards and makes answers predictable, which matters for DNSSEC-signed zones.

Who was impacted?

This change affected customers with zones that contain an Empty Non-Terminal (ENT) which is a descendant of a wildcard record.

What are Empty Non-Terminals?

In DNS, an Empty Non-Terminal is an intermediate domain name in a DNS hierarchy that exists only because it is a path to a deeper name, but has no records of its own. For example, in the following zone b.c.example.com is an Empty Non-Terminal. It has no records itself, but exists because of a.b.c.example.com.

$ORIGIN example.com.
*.c.example.com.     IN  CNAME   one.test.
a.b.c.example.com.   IN  CNAME   two.test.

DKIM records are a common source of ENTs, because of how they are named.

What changed?

Let’s take the previous zone as a reference:

  • b.c.example.com is an Empty Non-Terminal. It has no records itself, but exists because of a.b.c.example.com.
  • According to RFC 4592, a query for b.c.example.com should return NOERROR with an empty answer section (also known as a NODATA response), indicating the name exists but has no records. Importantly, the wildcard at *.c.example.com should not apply here, because the name exists (even if empty).
  • On the other hand, a query for a name like x.c.example.com (which doesn’t exist) should be synthesized from the wildcard, returning a CNAME to one.test.

Before the change, DNSimple name servers did not follow RFC 4592 for ENTs. A query for an ENT under a wildcard returned the wildcard match.

For instance, querying b.c.example.com returned:

$ dig @127.0.0.1 b.c.example.com A +short
one.test.

Since December 1, 2025, DNSimple name servers answer with NOERROR and an empty answer section (no records), because b.c.example.com exists as an ENT (because of a.b.c.example.com).

What to do now

If a name under a wildcard now returns an empty answer and you want it to return the wildcard’s value, add an explicit record at that name. See How to Fix Empty Responses from Empty Non-Terminals.

Using the example above, to get the old answer back, add this record:

b.c.example.com.   IN  CNAME   one.test.

Have more questions?

If you have additional questions or need any assistance, just contact support, and we’ll be happy to help. You can also read more about DNS hosting at DNSimple.