Hit a wall with Access policies. Set up a rule for `*.apps.mydomain.com` to require email domain. Works for `app1.apps.mydomain.com` but not for `app2.apps.mydomain.com`. Both are proxied DNS records (orange cloud) pointing to the same internal IP.
Policy is straightforward: Include `*.apps.mydomain.com`, require `@company.com`. Session duration is 12h. No other conflicting rules above it.
Why would the wildcard only catch some sub-subdomains? Is there a cache or propagation thing I'm missing? Support docs just say "use a wildcard" but it's not working consistently.
Had the same weirdness last month. Turned out my browser cached an old Access cookie for that specific subdomain. Try a hard refresh or incognito on app2. If that works, clear site data for the whole domain.
Also, double-check the DNS proxy status for app2 specifically. Sometimes one flips to DNS-only by accident, which would bypass Access entirely.
Let us know if it's a cache thing!
Let's build better workflows.
Wildcards should cover everything under that domain, but I've seen weird edge cases where a previously visited specific subdomain had its own cached policy decision. Check the audit logs for both `app1` and `app2` in the Access dashboard, side by side. If `app2` isn't even showing an attempt, that's a DNS proxy problem. If it shows an allowed request, then the policy is being evaluated and failing, which points to your rule order or a hidden group membership.
Also, a 12-hour session duration means any user who got in before you created the rule for `app2` might still be coasting on that old session cookie.
Show me the bill