diff --git a/dev2/dev2-site b/dev2/dev2-site
index d2f89aa..0809b7b 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1677,7 +1677,6 @@ def cmd_dns(args):
         recs = recs.get("records", recs) if isinstance(recs, dict) else recs
         for d in ds:
             host = "@" if d == zone else d[: -len(zone) - 1]
-            if host.startswith("*"): note(f"{d}: wildcard; set A * manually if needed"); host = "*"
             for r in recs:
                 if r.get("name") == d and r.get("type") in ("ALIAS", "CNAME", "A", "AAAA"):
                     sh(["porkbun", "rm", zone, host, "--type", r["type"], "--yes"], check=False)
diff --git a/dev2/sites.d/net-gateway.w3bs.org.json b/dev2/sites.d/net-gateway.w3bs.org.json
index a2327ce..1a24ada 100644
--- a/dev2/sites.d/net-gateway.w3bs.org.json
+++ b/dev2/sites.d/net-gateway.w3bs.org.json
@@ -2,7 +2,9 @@
   "site": "net-gateway.w3bs.org",
   "nginx_app": false,
   "domains": [
-    "*.whatever.w3bs.org"
+    "*.whatever.w3bs.org",
+    "*.agent.w3bs.org",
+    "*.hacker.w3bs.org"
   ],
   "port": 3209,
   "max_body": "64m",
@@ -11,7 +13,17 @@
       "host": "*.whatever.w3bs.org",
       "port": 3209,
       "max_body": "64m"
+    },
+    {
+      "host": "*.agent.w3bs.org",
+      "port": 3209,
+      "max_body": "64m"
+    },
+    {
+      "host": "*.hacker.w3bs.org",
+      "port": 3209,
+      "max_body": "64m"
     }
   ],
-  "notes": "Dedicated W3BS Net Moshpit wildcard vhost. DNS and TLS cover *.whatever.w3bs.org. The W3BS app serves only manually approved names from W3BS_NET_APPROVED_NAMES."
+  "notes": "Dedicated W3BS Net name-routing vhost. DNS and TLS cover *.whatever.w3bs.org, *.agent.w3bs.org and the Moshpit backfill namespace *.hacker.w3bs.org; add another suffix here when W3BS Net opts in that namespace. The independent W3BS registry decides active names."
 }