The behaviour that you describe is entirely expected; what I find surprising is the claim that you got a different result with PowerDNS (you may want to file a bug report if you can reproduce this with a current version).
The reason why this is the expected behaviour is that wildcard functionality in DNS is defined in such a way that the wildcard only expands to names that do not exist below the wildcard entry (ie, essentially names where you would otherwise get an NXDOMAIN
response).
What may not feel intuitive here is that with the two records in the question, the name www.example.com
is considered to exist (even though it doesn't have any records of its own) because it is an intermediate node in the branch that leads to abcd.www.example.com
(which does have records). (This type of intermediate tree node without records is referred to as an empty non-terminal or ENT).
As the name www.example.com
exists, it follows from the definition of how wildcards work that it should not be affected by *.example.com
and you will get a NODATA
response (indicated by NOERROR
status with SOA
in the authority section) unless you add records to www.example.com
itself.