Understand which names match
Test the exact hostnames your applications use, including names with explicit records and names that do not yet exist. A wildcard may cover some missing names while existing records continue to take precedence.
Do not assume a wildcard handles email, certificate validation, or service discovery correctly. Those systems may require explicit record types or names, and a broad answer can direct unintended hostnames to the same destination.
Limit and verify its reach
Use a wildcard only when routing unknown subdomains to one target is intended. Review the security implications if applications treat every hostname as a trusted tenant or route.
Query authoritative and recursive DNS for representative names and test the application’s hostname handling. Document exceptions so future specific records do not silently conflict with the wildcard behavior.