# F5XC domain / SNI match resolver

> Paste the domain lists of one or more F5XC HTTP load balancers and a test hostname, and see which load balancer and domain entry wins - exact beats wildcard, with the Default LB catching the rest.

- Tool: https://ronutz.com/en/tools/f5xc-domain-sni-match-resolver
- Family: Networking

---

## What it does

This tool answers a precise F5 Distributed Cloud (XC) question: given several HTTP load balancers and their domain lists, which one serves a particular hostname? Paste the load balancers as a JSON array and a test hostname, and the resolver names the winning load balancer and domain entry, shows why, and flags the configuration hazards that make domain matching go wrong. It runs entirely in your browser.

## How XC picks a load balancer

When a request arrives, XC has already narrowed things to the load balancers that share the destination IP and port (the advertise policy). Among those, it picks the most specific domain match. An exact FQDN - app.example.com listed literally - beats a wildcard like *.example.com. The hostname it matches on comes from the SNI value when the client uses HTTPS, or the Host header when the client uses plain HTTP. If nothing matches and one load balancer is marked as the Default for that advertise policy, the Default catches the request; if there is no Default, the hostname is not picked up at all.

## Wildcards and the apex

A wildcard domain is a suffix match: *.example.com covers foo.example.com, but it does not cover the apex example.com, and a wildcard TLS certificate only covers a single label. That is why serving both www.example.com (or any subdomain) and the bare example.com needs the apex added as its own domain. The tool makes the wildcard-versus-apex distinction explicit in every result.

## The hazards it flags

Domain matching breaks in a few recognizable ways, and the tool warns about each. Configuring both a wildcard (*.example.com) and its apex (example.com) on different load balancers that use automatic certificates is something F5 specifically advises against. Two load balancers claiming the same exact domain, or two marked as Default on the same advertise policy (only one is allowed), are conflicts. A hostname that matches two entries with equal specificity is ambiguous. And a multi-label hostname that matches a wildcard will route but may fail certificate validation, since the wildcard cert covers only one label.

## Standards and references

- [DevCentral: F5 Distributed Cloud - Listener Logic (most-specific domain match, Default LB per advertise policy)](https://community.f5.com/kb/technicalarticles/f5-distributed-cloud---listener-logic/326096) - the most-specific match wins (exact over wildcard); SNI (HTTPS) or Host header (HTTP); one Default LB per advertise policy (IP+port) catches unmatched
- [F5 Distributed Cloud: Load Balancing and Service Mesh (domains as partial match, port in domain)](https://docs.cloud.f5.com/docs-v2/platform/concepts/load-balancing-and-mesh) - domains are DNS names, wildcard *.foo.com partial match, must match certs and host headers, includes port for non-standard ports (*.foo.com:8080)
- [F5 Distributed Cloud: Create TCP Load Balancer (wildcard + apex auto-cert warning)](https://docs.cloud.f5.com/docs-v2/multi-cloud-app-connect/how-to/load-balance/create-tcp-load-balancer) - do not add both a wildcard and the top-level (apex) domain if using an automatic certificate for different load balancers
- [F5 K000161238: multiple custom TLS certificates on a single HTTP or TCP Load Balancer](https://my.f5.com/s/article/K000161238) - several domains/certs on one LB, host-header routing per domain - context for multi-domain LBs

## Related reading

- [How XC Decides Which Load Balancer Wins a Hostname: Listener Logic, Wildcards, and the Apex](https://ronutz.com/en/learn/f5xc-domain-matching-and-listener-logic.md): The advertise policy narrows a request to an IP and port; within it, XC picks the most specific domain match (exact beats wildcard). The hostname comes from SNI (HTTPS) or the Host header (HTTP). One Default load balancer per advertise policy catches the unmatched. Wildcards are suffix matches that do not cover the apex, wildcard certs cover a single label, and mixing a wildcard with its apex across auto-cert LBs is a hazard.