# Simplifying Egress Routing to Wildcard Destinations

DevFeed: [Simplifying Egress Routing to Wildcard Destinations](<https://devfeed.tech/articles/simplifying-egress-routing-to-wildcard-destinations-48811.md>)

Original publisher: [Read original article](<https://istio.io/latest/blog/2026/egress-dynamic-dns/>)

Author: Rudrakh Panigrahi (Salesforce)

Published: 2026-04-09T00:00:00Z

Content type: article

Language: en

Sources: [Istio Blog](<https://devfeed.tech/sources/istio-blog.md>)

Topics: [istio](<https://devfeed.tech/topics/istio.md>), [service-mesh](<https://devfeed.tech/topics/service-mesh.md>), [TLS handshake](<https://devfeed.tech/topics/tls-handshake.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [gateway](<https://devfeed.tech/topics/gateway.md>), [networking](<https://devfeed.tech/topics/networking.md>), [proxy](<https://devfeed.tech/topics/proxy.md>)

Tags: [ambient](<https://devfeed.tech/tags/ambient.md>), [egress](<https://devfeed.tech/tags/egress.md>), [gateway](<https://devfeed.tech/tags/gateway.md>), [istio](<https://devfeed.tech/tags/istio.md>), [mesh](<https://devfeed.tech/tags/mesh.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [networking](<https://devfeed.tech/tags/networking.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [routing](<https://devfeed.tech/tags/routing.md>), [service-entry](<https://devfeed.tech/tags/service-entry.md>), [services](<https://devfeed.tech/tags/services.md>), [tls](<https://devfeed.tech/tags/tls.md>), [tls-handshake](<https://devfeed.tech/tags/tls-handshake.md>), [traffic](<https://devfeed.tech/tags/traffic.md>), [traffic-management](<https://devfeed.tech/tags/traffic-management.md>), [waypoint](<https://devfeed.tech/tags/waypoint.md>), [wildcard](<https://devfeed.tech/tags/wildcard.md>)

## AI overview

This article explains Istio support for wildcard ServiceEntry resources with DYNAMIC_DNS resolution. The feature lets sidecars route HTTPS traffic to wildcard destinations while reducing the need to register dynamic subdomains individually. It also describes the earlier egress-gateway and SNI-based approach.

## Source excerpt

Overview Controlling egress traffic is a common requirement in service mesh deployments. Many organizations configure their mesh to allow only explicitly registered external services by setting: meshConfig.outboundTrafficPolicy.mode = REGISTRY_ONLY With this configuration, any external destination must be registered in the mesh using resources such as ServiceEntry with fully qualified domain names and a DNS resolution type. apiVersion: networking.istio.io/v1 kind: ServiceEntry metadata: name: external-wikipedia-https namespace: istio-system spec: hosts: - "www.wikipedia.org" ports: - name: tls number: 443 protocol: TLS location: MESH_EXTERNAL resolution: DNS exportTo: - "*" However, some external services expose many dynamic subdomains where applications may need to access endpoints such as: https://en.wikipedia.org https://de.wikipedia.org https://upload.wikipedia.org As the list of hostnames grows, registering each one individually quickly becomes impractical to manage and scale. To address this, Istio needs support for wildcard hostname registration. Why wildcard HTTPS egress is difficult When a workload initiates an HTTPS connection, the destination hostname is transmitted in the TLS handshake via the Server Name Indication (SNI) field. For example, a client calling https://en.wikipedia.org sends the hostname en.wikipedia.org in the ClientHello SNI field during the TLS handshake. Istio sidecars intercept outbound connections and determine whether the destination is registered and how it should be routed. However, Istio's routing model normally requires the upstream destination to be known ahead of time. Even if a wildcard match is used in routing rules, the final upstream cluster must still correspond to a statically configured service. Because different subdomains may resolve to different endpoints, routing directly to wildcard hosts was historically not straightforward. SNI routing via Egress Gateway This problem was previously addressed in the Istio blog post