The app claims applinks:*.w22574221-aasa.pages.dev and the AASA is hosted
only at the parent w22574221-aasa.pages.dev. Neither host below serves its
own AASA, and neither resolves in DNS — so the only variable is how many labels deep the
tapped host sits below the parent.
Do not tap these here. Copy each into Notes, then tap it there. "Opens the Salesforce app" = the wildcard matched at that depth. "Opens Safari (or fails to load)" = the wildcard did not match at that depth.
1 LABEL below parent — control (expect APP) https://one.w22574221-aasa.pages.dev/x?fromEmail=1 2 LABELS below parent — THE QUESTION https://one.two.w22574221-aasa.pages.dev/x?fromEmail=1Interpretation:
• 1-label opens app, 2-label opens Safari → wildcards are single-label only →
*.salesforce.com can never reach <tenant>.my.salesforce.com. No wildcard fix.
• both open app → wildcards match multi-label → fixing salesforce.com's root AASA
would cover every tenant.
• neither opens app → association didn't establish (stale cache / bad fetch); hard cache-bust and retry —
result is inconclusive until the 1-label control passes.