The mail2.clarion-hotels.cz NSEC proves that mail2.clarion-hotels.cz exist so the wildcard (*.clarion-hotels.cz) should not match. Mark ; <<>> DiG 9.11.0pre-alpha <<>> _tcp.mail2.clarion-hotels.cz tlsa +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18595 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 6, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;_tcp.mail2.clarion-hotels.cz. IN TLSA ;; ANSWER SECTION: _tcp.mail2.clarion-hotels.cz. 1778 IN CNAME clarion-hotels.cz. _tcp.mail2.clarion-hotels.cz. 1778 IN RRSIG CNAME 5 2 1800 20140924121306 20140825121306 13077 clarion-hotels.cz. M8OQ5fcnOYPX2XXvV9Cgefkjv2AHYFLAMeDfUpBuSk1PBFG6s/4tMSLb C/0r72TOjZupOHe5vizyzamAcE6m7dA4tlXGlWkTapf95lKFRokqjQow eRESgmZSS/b43jgxLv/+FRsu3rYnz77j3cC413qBn0PDDKLbepk0YEZC yTk= ;; AUTHORITY SECTION: mail2.clarion-hotels.cz. 1778 IN NSEC clarion-hotels.cz. A RRSIG NSEC mail2.clarion-hotels.cz. 1778 IN RRSIG NSEC 5 3 3600 20140924121306 20140825121306 13077 clarion-hotels.cz. WlUUsb1EqhP5mUfJ5DXpxvVs7Tw4h5802WCwXy4B2NByTbj3SfurhbV7 HBxPFA/I5OR4VkbWsFr7LlOpb93xRmEXt98afdrzzrKIgMIoNHu4oHDe ykeuV/7epjuHOxpZUKtfhe48ktKZ0NRievAyCUxiJA8evpgifR7AKKqS yGA= clarion-hotels.cz. 1625 IN SOA ns.forpsi.net. admin.forpsi.com. 2014082501 3600 1800 2592000 3600 clarion-hotels.cz. 1625 IN RRSIG SOA 5 2 3600 20140924121306 20140825121306 13077 clarion-hotels.cz. F5DurWWNlg9zQrvFMQrdNNjH58Zv/TTVBQSOtslMYlwXWp3ZcJGCC1Ra veDuerwFv5dQUsBQIJpQc5eZmyXXH8YA5rOLBK1x19ej0hl1T3yi3pG6 4SJFCrzSIIFVKzX7nKDtfnFK/Zq3X6db7oh9I+gpNnyojuDCccuQNwov kQw= clarion-hotels.cz. 1625 IN RRSIG NSEC 5 2 3600 20140924121306 20140825121306 13077 clarion-hotels.cz. OOeXzp0449w2dXf6zdvnidH69d27+9kPH6fJP9CK+coXuMiZ7WwheIn8 qZrhqYPu9xrnpgmYYkOeuaWDq2b+7rxKzzJTw/0hAjjO8vKRMr2sPyNi CpM2btBTM2FrKZvFJZegMYafo37QH05cg47hXAjEiyEYCMlJfNmMx+AN le8= clarion-hotels.cz. 1625 IN NSEC *.clarion-hotels.cz. A NS SOA MX RRSIG NSEC DNSKEY ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Sep 05 09:06:45 EST 2014 ;; MSG SIZE rcvd: 925 -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org