fastly-wildcard-subdomain-compute-edge

Fastly Wildcard Subdomain Routing for Compute@Edge

Problem

Wildcard subdomains (*.example.com) don't work on Fastly Compute@Edge services even after:

• Creating the domain with fastly domain-v1 create
• Setting up DNS records
• The static publisher working fine for the apex domain

Symptoms include:

• 500 errors with "Fastly error: unknown domain: subdomain.example.com"
• PublisherServer returning empty responses (content-length: 0) for subdomain requests
• TLS subscriptions stuck in "pending" state
• DNS resolving to wrong targets

Context / Trigger Conditions

1. Wrong SNI endpoint: TLS certificate is "issued" but edge serves default certificate (CN=j.sni-644-default.ssl.fastly.net instead of your domain).

   CRITICAL: The TLS configuration name tells you which SNI endpoint to use:

   • "HTTP/3 & TLS v1.3 + 0RTT (x.sni)" → DNS to x.sni.global.fastly.net.
   • "HTTP/3 & TLS v1.3 (w.sni)" → DNS to w.sni.global.fastly.net.
   • Default/legacy → DNS to j.sni.global.fastly.net.

   Check your TLS configuration:

   FASTLY_KEY=$(fastly profile token) && curl -s -H "Fastly-Key: $FASTLY_KEY" \
     "https://api.fastly.com/tls/configurations" | jq '.data[] | {id: .id, name: .attributes.name}'
   

   Verify by connecting directly to the correct endpoint:

   echo | openssl s_client -servername subdomain.yourdomain.com \
     -connect x.sni.global.fastly.net:443 2>/dev/null | openssl x509 -noout -subject
   

2. DNS trailing dot issue: CNAME records resolve to target.com.yourdomain.com instead of target.com because the DNS provider appends the zone name without a trailing dot.

   Check with: dig @ns-server *.yourdomain.com CNAME +short

   Bad: x.sni.global.fastly.net.yourdomain.com. Good: x.sni.global.fastly.net.

3. Domain not activated: Fastly domain-v1 shows "activated": false, "verified": false even after DNS is set up.

   Check with:

   curl -s -H "Fastly-Key: $(fastly profile token)" \
     "https://api.fastly.com/domain-management/v1/domains/DOMAIN_ID" | jq