A wildcard DNS record answers for any subdomain you have not defined explicitly, which is how a service gives every customer their own address without touching DNS for each one.

*.yourdomain.com.  300  IN  A  1.2.3.4

The specific record always wins

If mail.yourdomain.com exists, it is used. The wildcard only answers for names with no record of their own - so it cannot break what you already have.

The certificate has to match

A normal certificate for yourdomain.com does not cover its subdomains. Without a wildcard certificate, every new subdomain shows a browser warning - which looks exactly like a hacked site to a customer.
certbot certonly --manual --preferred-challenges dns \\n  -d yourdomain.com -d "*.yourdomain.com"

A wildcard certificate can only be issued through DNS validation, not the usual HTTP check. That means an API token for your DNS provider if you want it to renew unattended - and unattended is the only kind worth having.

The web server needs to accept them

server {
    server_name ~^(?<sub>.+)\.yourdomain\.com$;
    root /var/www/tenants/;
}

That captures the subdomain and uses it, which is how one server block serves a thousand customers.

What to watch

  • A typo now resolves instead of failing, so a mistyped address reaches your server rather than erroring.
  • Anything that trusts the hostname needs to validate it - a tenant name from a URL is user input.
If you only need a handful of subdomains, define them. A wildcard is for the case where you genuinely cannot know the names in advance.