Wildcard DNS gets sold as a magic bullet for subdomain routing, and it mostly deserves the skepticism. A record like *.example.com does route requests for subdomains you never defined, but it does not override anything you defined explicitly, and it says nothing about where mail goes. People conflate those two behaviors constantly, then wonder why their catch-all email setup swallows some addresses and bounces others. The fix is boring and precise: put your MX records at the apex, use wildcard A or CNAME records for web and service routing, and verify the mail path with a random-subdomain RCPT test before you trust it.
What wildcard records actually match, and what they silently skip
A wildcard record is a fallback, not a blanket. When a resolver looks up foo.example.com, it first checks for an exact record named foo. If one exists, that record wins and the wildcard is never consulted. The wildcard only answers when no exact match exists at that name. This is why a domain can have a wildcard A record pointing at one server and still send www.example.com to a completely different host: the explicit www record takes precedence, full stop. The same precedence logic applies to MX, TXT, and every other type. Skeptics who have watched a wildcard «fail» usually just had an explicit record shadowing it.
The second thing wildcards skip is the apex itself. A record written as *.example.com does not match example.com. The bare domain needs its own records. That distinction matters enormously for mail because mail is conventionally addressed to the apex, and catch-all reception is a property of the mail server, not of DNS. If you want every address at example.com to land in one inbox, the MX record belongs at the apex and the mail server does the catching. Wildcard DNS has no role in that decision. Confusing the two is the root of most broken setups I have debugged.
There is also the wildcard MX trap. Some people try to route mail for subdomains by publishing *.example.com MX 10 mail.example.com and expecting it to work. Standards allow it, but real-world support is patchy. Several hosting control panels refuse to save a wildcard MX, some resolvers treat it inconsistently, and a fair number of mail transfer agents ignore it outright. Even when it resolves, you now have a mail path that depends on wildcard expansion for every subdomain, which is fragile. If you need mail on a specific subdomain, publish an explicit MX for that subdomain. If you need catch-all behavior, do it at the apex and let the server handle recipients.
The working pattern: MX at the apex, wildcards for everything else
Here is the layout that survives contact with reality. At the apex, publish your MX records pointing at the mail host that runs your catch-all mailbox, plus the SPF and DKIM TXT records that host requires. At the apex, also publish an A record for your main site. Then add a wildcard A or CNAME for subdomain routing, depending on whether you want to pin an IP or alias another name. If you use a CNAME wildcard, remember that CNAMEs cannot coexist with other record types at the same name, which is another reason the apex stays on A records. The wildcard catches everything undefined; the apex handles mail and the primary site; explicit records handle the handful of subdomains that need special treatment.
When the mail side is a service like AllMail, the apex MX points at their infrastructure and the catch-all inbox receives emails sent to any address on the domain. That includes addresses you never created, which is the entire point for link building and scraper workflows. AllMail offers POP3 and IMAP access so tools can pull messages from that single mailbox, and it monitors DNSBL blacklists so you find out when the domain lands on a list before your reply rates collapse. The DNS side stays simple: one set of apex MX records, one wildcard for routing, and no wildcard MX experiments. If you are running allmail.one domains for GSA SER, RankerX, or Xrumer campaigns, that separation is what keeps the mail path predictable while subdomains spin up freely.
Verification is where most people stop short. Do not assume the catch-all answers just because the zone file looks right. Run a random-subdomain RCPT test: open a connection to the mail host, issue MAIL FROM, then RCPT TO a nonsense address like zk4f9q7x@example.com, and read the response code. A 250 or 251 means the server accepted it and the catch-all is live. A 550 means it rejected the recipient, which usually points to a catch-all that was never enabled or an MX record pointing at the wrong host. Repeat the test with a random subdomain address if you are trying to route mail that way, and you will quickly see whether your host honors wildcard MX or quietly drops it. Testing takes thirty seconds and saves hours of debugging silent bounces.
Two more details worth pinning down. First, propagation is not instant and TTLs lie to you during testing, so flush your resolver cache or query an authoritative server directly before concluding a record is wrong. Second, wildcard routing and catch-all mail are independent systems that only look related. A wildcard A record can route anything.example.com to a web server while mail for that subdomain goes nowhere, and that is fine if you never intended mail there. Decide per subdomain whether you need web routing, mail reception, or both, and publish explicit records for the exceptions. The wildcard is a convenience for the long tail, not a policy.
If you are setting this up for SEO tooling, the practical checklist is short. Point apex MX at a provider that supports catch-all and gives you POP3 or IMAP access, keep the wildcard on A or CNAME only, test acceptance with a random RCPT before launching a campaign, and watch blacklist alerts so a burned domain does not take your sending down with it. AllMail runs a 3-day free trial, accepts crypto payments in USDT and USDC across TRC-20, BEP-20, and Polygon, and requires zero KYC, which suits anonymous catch-all email setups where identity verification would defeat the purpose. Configure the zone once with that apex-plus-wildcard split, verify the catch-all actually answers, and you can stop babysitting DNS and get back to the work that pays.