The Approved Sender entries with wildcards "*" do not match the senders with layers of subdomains.
Approved Sender entry: *@*.corelab.com
email@example.com > match
firstname.lastname@example.org > unmatch
email@example.com > unmatch
The following screenshot shows the Approved Senders setting page:
Click image to enlarge.
The Approved Sender list only supports up to the 2nd layer subdomains with wildcard "*".
This is product limitation by design.