DNS/tinydnssecについて、ここに記述してください。

http://www.tinydnssec.org/
  DNSSEC for tinydns

{{{
The interpretation of wildcard records now matches the description in RFC-1034 section 4.3.3. Specifically, if there's a wildcard *.x and a record for a.x, then a query for y.a.x will not be answered using the wildcard (for a label 'a' and series of labels 'x' and 'y').
This change is required for signed domains, because authentication of negative responses requires a common understanding between client and server about the meaning of wildcards.
}}}