diff --git a/configurator/public/index.html b/configurator/public/index.html
index 67550a3..7425cd9 100644
--- a/configurator/public/index.html
+++ b/configurator/public/index.html
@@ -277,7 +277,25 @@ cache_log /var/log/squid/cache.log
 `;
 }
 function genDomains(s) {
-  return s.domains.map(d => d.startsWith('*.') ? '.' + d.slice(2) : d).join('\n') + '\n';
+  let wildcardBases = s.domains
+    .filter(d => d.startsWith('*.'))
+    .map(d => d.slice(2));
+  wildcardBases = wildcardBases.filter(base =>
+    !wildcardBases.some(other => other !== base && base.endsWith('.' + other))
+  );
+  const isCovered = d => wildcardBases.some(b => d === b || d.endsWith('.' + b));
+  const seen = new Set();
+  const out = [];
+  for (const base of wildcardBases) {
+    const dotted = '.' + base;
+    if (!seen.has(dotted)) { out.push(dotted); seen.add(dotted); }
+  }
+  for (const d of s.domains) {
+    if (d.startsWith('*.')) continue;
+    if (isCovered(d) || seen.has(d)) continue;
+    out.push(d); seen.add(d);
+  }
+  return out.join('\n') + '\n';
 }
 function genWpad(s) {
   return `function FindProxyForURL(url, host) {
diff --git a/configurator/server.js b/configurator/server.js
index 9396d89..10184d0 100644
--- a/configurator/server.js
+++ b/configurator/server.js
@@ -105,11 +105,40 @@ cache_log /var/log/squid/cache.log
 }
 
 function generateVpnDomains(s) {
-  return (
-    s.domains
-      .map((d) => (d.startsWith("*.") ? "." + d.slice(2) : d))
-      .join("\n") + "\n"
-  );
+  // Wildcards: '*.foo.bar' -> covers 'foo.bar' und alle Subdomains in squid
+  let wildcardBases = s.domains
+    .filter((d) => d.startsWith("*."))
+    .map((d) => d.slice(2));
+
+  // Dedupe: wenn '*.bar' und '*.foo.bar' beide drin sind, '*.foo.bar' droppen
+  wildcardBases = wildcardBases.filter((base) => {
+    return !wildcardBases.some(
+      (other) => other !== base && base.endsWith("." + other)
+    );
+  });
+
+  const isCoveredByWildcard = (d) =>
+    wildcardBases.some((base) => d === base || d.endsWith("." + base));
+
+  const seen = new Set();
+  const out = [];
+
+  for (const base of wildcardBases) {
+    const dotted = "." + base;
+    if (!seen.has(dotted)) {
+      out.push(dotted);
+      seen.add(dotted);
+    }
+  }
+
+  for (const d of s.domains) {
+    if (d.startsWith("*.")) continue;
+    if (isCoveredByWildcard(d) || seen.has(d)) continue;
+    out.push(d);
+    seen.add(d);
+  }
+
+  return out.join("\n") + "\n";
 }
 
 function generateWpadDat(s) {