The Approved Sender entries with wildcards "*" do not match the senders with layers of subdomains.
For example:
Approved Sender entry: *@*.corelab.com
username@1st.corelab.com > match
username@2nd.1st.corelab.com > unmatch
username@3rd.2nd.1st.corelab.com > unmatch
The following screenshot shows the Approved Senders setting page:
Click image to enlarge.
The Approved Sender list only supports up to the 2nd layer subdomains with wildcard "*".
This is product limitation by design.