According to the PostgreSQL documentation:

A host name specification that starts with a dot (.) matches a suffix of the actual host name. So .example.com would match foo.example.com (but not just example.com).

So I put this line in pg_hba.conf and restarted PostgreSQL:

hostssl market_data market_data_access .horsholm.dk md5

Then I attempt to connect to the database:

psql "postgresql://market_data_access@<server-IP>:5433/market_data?sslmode=require"

Instead of a password prompt, I get this:

psql: FATAL:  no pg_hba.conf entry for host "", user "market_data_access", database "market_data", SSL on

Just to check, I make reverse DNS look-up of the IP address listed in the error message:

$ host is an alias for 131.129-
131.129- domain name pointer kommune.horsholm.dk.

What am I doing wrong?

  • 1
    Did you try to connect using the hostname instead of the IP, in your psql line? Commented Jul 12, 2018 at 18:35

2 Answers 2


It's not sufficient that resolves to kommune.horsholm.dk that matches the wildcard.

After checking that, Postgres will try to resolve kommune.horsholm.dk and find that it doesn't resolve to (as it doesn't resolve at all in this particular case)

$ host kommune.horsholm.dk
Host kommune.horsholm.dk not found: 3(NXDOMAIN)

Doc quote:

If a host name is specified (anything that is not an IP address range or a special key word is treated as a host name), that name is compared with the result of a reverse name resolution of the client's IP address (e.g., reverse DNS lookup, if DNS is used). Host name comparisons are case insensitive. If there is a match, then a forward name resolution (e.g., forward DNS lookup) is performed on the host name to check whether any of the addresses it resolves to are equal to the client's IP address. If both directions match, then the entry is considered to match

  • How can I tell which of the two requirements are not satisfied for my dns?
    – eugene
    Commented Aug 15, 2019 at 14:35

The reverse DNS look up for the IP did not resolve to a host with name *.horsholm.dk. If we study the output of your host command, you can see that the response does not contain an exact mapping for the IP to the host (All you are getting is a range of IPs) . A successful reverse DNS look up would look like below:

host domain name pointer vm-test1.vpc.dev.net.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.