subfinder: a reported name is not a wildcard

Each line is one reported name

The output lists hostnames. Each one is a name that appeared for that input on that run. Three lines are three names. They do not say the zone answers for every label, and they do not say a star record exists.

A name you did not expect is still one name. It is a candidate for the inventory. It is not, by itself, the pattern of the whole zone.

A wildcard is a different observation

A wildcard claim needs a lookup of a label you chose at random, recorded with the answer. That lookup is not inside a list of known names. If you did not make it, write “wildcard not tested.”

Do not add a star to the inventory because the list looks long. Length is how many names were printed.

What to file

File the input domain, the run time, and the hostnames that were printed. If a random-label lookup exists, file it separately with the label and the answer. Do not file a star next to a list that never tested one.

Worked case: three names called a star record

A lab run for lab.example prints app.lab.example, files.lab.example, and status.lab.example. A draft says the zone is a wildcard because three names came back, and adds *.lab.example to the asset list.

The note lists the three hostnames and the input domain. Wildcard: not tested. The star is removed from the list. A later random-label lookup can be attached if someone runs it, and that lookup is its own line.

input: lab.example
names printed: app, files, status
count: 3
random-label lookup: none
write: three reported names
not: *.lab.example