How to abort or 403 sub-subdomains with a wildcard?

[msencenb_wiq (Matt S)]

You’re supposed to reject those domains on your ask endpoint. Are you not doing that? You should only allow known domains, you should never blanket allow domains.

Agreed! I had set this infrastructure up before the ask endpoint was required and am now seeing that exact situation. The file based solution was taken from this post:

Can I send "ASK" request to local file instead of URL?

Today I’m sending the ASK request like that: on_demand_tls { ask https://www.example.com/isDomainValid.php } And sometimes it send us a lot of traffic to the URL. Instead of that I thought it will be better to send the “ASK” into a local file in the server. This file will include an update list of all the valid domains in the system. Maybe Caddy can also save the file in is memory for some seconds so it will prevent easy DDOS attack. Can we do something like that?

In a panic last night to get something up to shield my caddy servers. I’ll be implementing the ask endpoint in my real backend today to protect moving forward. I appreciate the tip on deleting the domains as well.

Part of the problem is I do need to serve the certificate for the www version of this domain (for their website), but not any of the other subdomain stuff that their webmaster misconfigured—I understand what you are saying though, that should just be part of the ask endpoint.

That’s the way to do it. Just write a regexp matching Host to reject those requests.

Thank you