The firewall first tokenizes the FQDNs and the domain names in the DNS proxy rules. In a domain name, a string delimited by a period (.) is a token.
The matching process is an exact token match between the FQDN and the domain name in the rule; partial strings are not matched.
An exception to the exact match requirement is the use of the wildcard—an asterisk (*). The * matches one or more tokens.
This means a rule consisting of only a wildcard (*) matches any FQDN with one or more tokens.
You can use an * in any position: preceding tokens, between tokens, or trailing tokens (but not with other characters within a single token).
Multiple wildcards (*) can appear in any position of the domain name: preceding tokens, between tokens, or trailing tokens. Each non-consecutive * matches one or more tokens.
When wildcards are used in consecutive tokens, the first * matches one or more tokens; the second * matches one token.
This means a rule consisting of only *.* matches any FQDN with two or more tokens.
Consecutive and non-consecutive wildcards can appear in the same rule.
As long as the last token of the rule is not an *, a comparison will match if all tokens in the rule match the FQDN, even when the FQDN has additional trailing tokens that the rule doesn’t have.
This rule ends with *, so the Implicit-tail-match rule doesn’t apply. The * behaves as stated; it matches one or more tokens.
In the case where an FQDN matches more than one rule, a tie-breaking algorithm selects the most specific (longest) rule; that is, the algorithm favors the rule with more tokens and fewer wildcards (*).
FQDN matches all three rules; the firewall uses Rule 3 because it is the most specific.
FQDN does not match Rule 1 because the * does not have a token to match.
FQDN matches Rule 1 and Rule 2 (because the * matches one or more tokens). The firewall uses Rule 1 because it is the most specific.
When working with wildcards (*) and Implicit-tail-match rules, there can be cases when the FQDN matches more than one rule and the tie-breaking algorithm weighs the rules equally.
To avoid ambiguity, if rules with an Implicit-tail-match or a wildcard (*) can overlap, replace an Implicit-tail-match rule by specifying the tail token.
Include a top-level domain in the domain name to avoid invoking an Implicit-tail-match that may match the FQDN to more than one rule.
If you use a wildcard (*), use it only as the leftmost token.
This practice follows the common understanding of wildcard DNS records and the hierarchical nature of DNS.
Use no more than one * in a rule.
Use the * to establish a base rule associated with a DNS server, and use rules with more tokens to build exceptions to the rule, which you associate with different servers.
The tie-breaking algorithm will select the most specific match, based on the number of matched tokens.