Wildcard records
A wildcard record answers for any subdomain you have not defined explicitly. It is useful and it is a common way to create surprises.
What a wildcard matches
A record whose name begins with an asterisk label — *.example.com — answers queries for any name at that level which has no record of its own.
Wildcards are the usual way to serve a subdomain per customer without adding a record for each one.
Any explicit record wins
A wildcard only applies where nothing else exists. If app.example.com has any record of its own, the wildcard never applies to it — and that is true per name, not per record type.
This surprises people: adding a TXT record to app.example.com for a verification check stops the wildcard A record from answering for app.example.com too, and the subdomain goes dark.
Deeper names are a special case
Wildcard matching is defined in RFC 4592. *.example.com does match a.b.example.com, but only while no name exists between them: the moment b.example.com gets a record of its own, everything beneath it stops matching the wildcard.
A wildcard also cannot solve certificates: a wildcard TLS certificate for *.example.com covers one label, for the same reason.