Wildcard CNAME causes unrelated content to display

[jspiewak]

We have a wildcard CNAME pointed to our GitHub Pages, e.g. *.example.com points to example.github.io.

When navigation to a certain subdomains, e.g. ftp and email, for which there are no pages, instead of the expected 404, we see content from “PDF Books Catalog”.

Searching Google, this is apparently not isolated to just us: http://lmgtfy.com/?q=PDF+Books+Catalog

Today we received a DMCA take down notice for this.

Is anyone else actively experiencing this?

[lee-dohm]

Thanks for writing in about this, and sorry for the trouble this has caused!

Setting up a wildcard DNS record will allow anyone to host a GitHub Pages site at one of your subdomains. This is something we specifically warn against in our documentation. As we don’t have any way of verifying domain ownership over DNS the only security method we can recommend is explicitly specifying the subdomain records you need and pointing them at GitHub.

To fix this you’ll need to remove your wildcard record and create an explicit CNAME record for each subdomain you want to use.

Additionally, it would also be very helpful if you could send a list of any affected subdomains you’ve noticed in to private GitHub Support at https://github.com/contact.

Thanks!